casibomguncel-qiris[.]icu

The domain casibomguncel-qiris.icu operates as an active generic phishing infrastructure. It targets users through deceptive login or credential harvesting pages, leveraging the .icu TLD and cloaked hosting to mimic legitimate services. Infrastructure analysis reveals resolution to IP address 172.67.195.203 protected by Google Trust Services SSL certificates, enabling encrypted delivery of malicious content while evading basic filters.

Evidence includes an exact VirusTotal score of 8/95 security vendors, registration through NICENIC INTERNATIONAL GROUP CO., LIMITED, and a creation date of June 25, 2026. Gridinsoft assigns a trust score of 0/100, confirming the domain remains active with no observed mitigation. These metrics establish consistent malicious classification across multiple detection layers without reliance on behavioral anomalies.

Users who accessed the domain should immediately revoke any entered credentials, enable multi-factor authentication on associated accounts, and conduct a full endpoint scan for unauthorized processes or browser extensions. Network logs should be reviewed for connections to 172.67.195.203, and future access must be blocked at the DNS or firewall level to prevent repeated exposure.