caseboattle[.]com

This domain, caseboattle.com, operates as a credential harvesting phishing site disguised as an online store specializing in rare collectibles and unique sets. The site presents itself as a legitimate marketplace for collectors, using the Russian-language page title "Редкие Коллекции и Уникальные Наборы - Идеально для настоящих коллекционеров и искателей находок" to lend credibility. Analysis indicates the site likely targets individuals interested in collectibles, enticing them to register accounts or make purchases to capture login credentials, payment details, or personal information. The use of a seemingly legitimate storefront increases the risk of users unwittingly disclosing sensitive data under false pretenses. Infrastructure analysis reveals multiple technical indicators supporting the phishing classification. The domain was registered on March 05, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with low-reputation domains. It resolves to the IP address 104.21.49.6, which is part of Cloudflare's network, a common tactic to obscure hosting origins and evade detection. The domain appears on one security blocklist and is flagged by 2 out of 95 security vendors on VirusTotal, including detection as a phishing threat. Additional technologies detected include Unpkg, Cloudflare Browser Insights, AOS, and HTTP/3, which are often employed to enhance site functionality and tracking capabilities while maintaining a veneer of legitimacy. Users who visited caseboattle.com should take immediate action to mitigate potential risks. If any credentials, payment details, or personal information were entered on the site, affected accounts should be secured by changing passwords and enabling multi-factor authentication where available. Monitor financial statements for unauthorized transactions and consider placing a fraud alert or credit freeze if payment data was disclosed. The domain's current offline status does not eliminate the risk of previously harvested data being exploited. Users are advised to verify the legitimacy of any communication referencing this domain and report suspicious activity to relevant financial institutions or cybersecurity authorities.