cassoncapitalv2[.]net

PhishDestroy has identified cassoncapitalv2.net as a credential theft phishing domain, designed to steal login credentials by impersonating the Casson Capital brand. The domain is currently offline, but during its active period it posed a significant threat to users who might have been tricked into entering sensitive information. The site featured a page titled 'Welcome Back to Casson,' further indicating its intent to mimic legitimate login portals.

Technical analysis reveals that the domain was created on March 11, 2025, and registered through Cosmotown, Inc. It resolves to IP address 63.176.8.218 and uses an SSL certificate issued by Let's Encrypt (E7), which provides a false sense of security. VirusTotal data shows that only 1 out of 95 security vendors flagged the domain as malicious, underscoring the challenge of detecting such threats. Additionally, the domain appears on one security blocklist, and its trust score is extremely low due to these indicators.

Given that cassoncapitalv2.net is now offline, users who have previously interacted with the site should change their passwords immediately and enable two-factor authentication on any accounts that may have been compromised. It is also advisable to monitor financial accounts for unusual activity. PhishDestroy recommends staying vigilant against similar phishing attempts by verifying domain authenticity before entering credentials, especially for financial services like Casson Capital.