casibom-girrdimadrestn[.]vip

On July 24, 2026 the domain casibom-girrdimadrestn.vip was flagged as a high‑risk, active phishing infrastructure. The domain was registered through NiceNIC International Group Co., Limited and first seen on February 21, 2026. DNS resolution points to 188.114.96.3, an IP owned by AS13335 Cloudflare, Inc., located in the United States. Both authoritative nameservers are hosted on Cloudflare (newt.ns.cloudflare.com and wren.ns.cloudflare.com), and the site leverages Cloudflare’s HTTP/3 support together with the third‑party library jsDelivr. The TLS certificate is issued by Google Trust Services under the WE1 profile, indicating a valid HTTPS endpoint despite the underlying malicious intent. An HTTP request returns status code 521, suggesting the origin server is refusing connections, a pattern often observed with takedown‑resistant phishing pages. The page title captured during analysis reads "Hawkins & Clarke | Global Asset Recovery Division," implying an attempt to impersonate a legitimate asset recovery service.

Detection telemetry shows that seven of ninety‑three VirusTotal scanners have flagged the domain, and Gridinsoft assigns a trust score of 0 / 100. The domain appears on one external security blocklist and is explicitly blocked by the PhishDestroy service. No additional public analysis of the page content is available, so the exact payload and credential‑capture mechanisms remain unconfirmed.

Defenders should immediately block casibom-girrdimadrestn.vip at network perimeters and update endpoint protection signatures to reflect the seven VirusTotal detections. Continuous monitoring of DNS queries for the associated Cloudflare nameservers is advised, as the infrastructure may be leveraged for further phishing campaigns.