casibom92454[.]com

This domain, casibom92454.com, is currently flagged as an active phishing threat targeting user credentials. Registered on February 27, 2026, through NiceNIC International Group Co., Limited, the domain has been detected on two security blocklists and appears in 23 threat intelligence pulses on AlienVault OTX. Analysis indicates it is still operational as of July 12, 2026, resolving to the IP address 172.67.154.175, which is associated with Cloudflare infrastructure. The domain is blocked by at least two security filters, and seven out of 95 security vendors on VirusTotal have flagged it as malicious, reinforcing its classification as a high-risk threat. The observable evidence suggests this is a generic phishing domain, though the exact content or targeted brand remains unconfirmed. The page title 'Just a moment...' is consistent with Cloudflare-protected sites, which often display this message during initial loading or when undergoing security challenges. The use of Cloudflare Browser Insights and HTTP/3 further indicates an attempt to obfuscate malicious activity behind legitimate CDN services. While the domain’s SSL certificate is issued by Let’s Encrypt—a common practice even among malicious actors—this does not mitigate the risk, as phishing sites frequently use valid certificates to appear trustworthy. Defenders should treat this domain as an active threat. The combination of recent registration, blocklist presence, and vendor detections aligns with typical phishing infrastructure. Network-level blocking is recommended, particularly for organizations where credential harvesting poses a significant risk. Additional monitoring of related domains registered through the same registrar or resolving to the same IP may uncover further malicious activity. Given the domain’s continued activity, security teams should prioritize investigating any user interactions with it, as the exact payload or targeted service remains unverified.