casibom-girdimadrsttn[.]vip

On July 24, 2026, analysis confirmed that the domain casibom-girdimadrsttn.vip is actively hosting a generic phishing campaign. The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and points to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site is protected by a TLS certificate issued by Google Trust Services under the WE1 hierarchy, indicating use of a legitimate certificate authority, but the certificate does not mitigate the malicious intent. Infrastructure inspection shows that the domain relies on Cloudflare DNS with nameservers newt.ns.cloudflare.com and wren.ns.cloudflare.com, and uses the jsDelivr CDN and HTTP/3 protocol, consistent with the observed traffic patterns for many phishing sites.

The page title returned by the server is “Hawkins & Clarke | Global Asset Recovery Division,” suggesting an attempt to impersonate a financial or recovery service. An HTTP 521 response code is observed, which typically denotes a web server refusing connections from Cloudflare, possibly indicating intermittent availability or active takedown attempts. The domain is listed on one security blocklist and has been flagged by the PhishDestroy blocking service. VirusTotal has recorded detections from five out of ninety‑three scanning engines, reinforcing the classification as malicious.

The Gridinsoft trust score is 0 out of 100, reflecting a complete lack of trustworthiness. Given the combination of recent registration, Cloudflare hosting, a valid SSL certificate, and multiple detection signals, defenders should treat the domain as high‑risk. Recommended mitigations include adding the domain and its resolving IP address to network‑level blocklists, updating URL filtering policies, and monitoring for any related traffic patterns. Continuous re‑evaluation is advised, as the threat actor may alter hosting or certificate details in future iterations.