casibom7221[.]com

Analysis of casibom7221.com indicates a high-risk credential-theft phishing site that remains active as of July 12, 2026. The domain was registered on April 28, 2026, through Fewmoretaps OU operating under Trustname.com, a registrar frequently associated with newly observed phishing campaigns. Infrastructure analysis reveals Cloudflare-hosted endpoints (172.67.170.168, AS13335) with nameservers lindsey.ns.cloudflare.com and rocco.ns.cloudflare.com, a pattern consistent with adversaries leveraging Cloudflare’s proxy services to obscure origin servers and evade takedowns. Technical indicators include a Let’s Encrypt SSL certificate (serial E7) and HTTP/3 support, suggesting recent configuration to mimic legitimate web properties. The site returns an HTTP 525 status, typically indicating SSL handshake failure, which may reflect misconfigured or intentionally disrupted TLS settings to hinder automated analysis. Detected technologies include Plesk and PHP, common components in phishing kits designed for rapid deployment and backend credential harvesting. Threat intelligence confirms the domain appears in eight AlienVault OTX pulses, with PhishDestroy listing it as blocked. One security blocklist has flagged the domain, while five of 91 security vendors on VirusTotal detect it as malicious. The Gridinsoft trust score of 0/100 further corroborates its classification as a confirmed phishing asset. Defenders should treat casibom7221.com as an active threat. Immediate actions include blocking the domain and IP at perimeter security controls, monitoring for internal connections to 172.67.170.168, and reviewing logs for credential submissions or redirects involving this host. The exact brand or service being impersonated remains unconfirmed; no specific page title or kit details are currently available for deeper attribution. Given the domain’s recent registration and Cloudflare proxy usage, expect rapid infrastructure changes to evade detection.