cascaede[.]xyz

This domain is flagged as a high-risk credential harvesting phishing site targeting users through deceptive login interfaces. Analysis indicates the infrastructure is designed to mimic legitimate authentication portals, likely to exfiltrate sensitive credentials such as usernames, passwords, and session tokens. The threat type aligns with generic phishing but exhibits targeted characteristics, including the use of modern web technologies to enhance deception. Infrastructure analysis reveals the domain cascaede.xyz was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. It resolves to the IP address 188.114.97.3, which is part of a network range known for hosting phishing infrastructure. Detection metrics show 12 out of 95 security vendors on VirusTotal flag the domain as malicious, while it appears on three distinct security blocklists. Additional technical indicators include a Gridinsoft trust score of 0/100, further corroborating its malicious nature. The domain employs AngularJS, HSTS, and Cloudflare services, which may be leveraged to obfuscate malicious activity and evade detection. Mitigation measures should prioritize blocking the domain and its associated IP address across network security controls. Users who may have interacted with the site should immediately reset credentials for any accounts accessed during the exposure window, particularly if the same credentials were reused across multiple platforms. Organizations are advised to implement multi-factor authentication (MFA) as an additional safeguard against credential-based attacks. Security teams should monitor for indicators of compromise (IOCs) related to this domain, including the IP address 188.114.97.3 and any subdomains or redirect chains linked to cascaede.xyz. Proactive threat hunting in logs for connections to the domain or its IP can help identify potentially compromised systems.