caivax[.]com

This domain, caivax.com, is flagged as an active credential harvesting phishing site targeting enterprise users. Analysis indicates the infrastructure is designed to mimic corporate login portals, likely for the purpose of stealing authentication credentials. The domain remains operational as of this assessment and poses a high-risk threat to users who may be deceived into entering sensitive information. Infrastructure analysis reveals the domain was registered through NiceNIC International Group Co., Limited on February 21, 2026, an unusually future-dated registration that may indicate an attempt to evade detection or establish long-term malicious operations. It resolves to IP address 104.21.23.244, hosted on AS13335 Cloudflare, Inc., a network frequently leveraged by threat actors to obscure origin servers. The domain appears on one security blocklist and is flagged by 14 of 95 security vendors on VirusTotal, with detection labels including 'phishing' and 'credential theft.' The SSL certificate is issued by WE1, a provider commonly associated with low-trust or ephemeral domains. The page title, 'Suspected phishing site | Cloudflare,' suggests the hosting provider has identified the domain as malicious, though no enforcement action has been taken to suspend it. Current status indicates the domain remains active and unresolved, continuing to resolve to the Cloudflare IP without intervention. Organizations are advised to implement immediate network-level blocking of 104.21.23.244 and the domain caivax.com across all security gateways. Endpoint protection should be updated to include this domain in phishing and credential theft detection rules. Users should be alerted to the threat, particularly those who may receive emails or messages directing them to enterprise login portals. Given the future-dated registration and Cloudflare hosting, ongoing monitoring is recommended to detect any shifts in infrastructure or evasion attempts.