casebaetle[.]com

This domain, casebaetle.com, is currently flagged as a high-risk phishing site targeting users through a skin-trading scam theme. Analysis indicates the domain was registered on March 6, 2026, via NiceNIC International Group Co., Limited, and resolves to the IP address 104.21.6.136. The page title, written in Russian, translates to 'Case-Battle — a unique platform created for true connoisseurs of cool skins,' suggesting a focus on virtual item trading or gambling-related fraud. No specific brand impersonation has been confirmed in available data, though the phrasing implies an attempt to lure users with promises of exclusive in-game items or rewards. Infrastructure analysis reveals the domain appears on two security blocklists and is actively blocked by PhishDestroy and BLP-Malware. AlienVault OTX records show the domain in 23 threat intelligence pulses, indicating repeated detection across multiple security communities. VirusTotal reports that 3 out of 95 security vendors have flagged the domain, a relatively low but non-zero detection rate that aligns with its recent registration and active status. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its free and automated nature. The exact content and functionality of the site remain unanalyzed, but the combination of a skin-themed lure, recent registration, and presence on blocklists supports its classification as a phishing domain. Defenders should treat this domain as active and high-risk, particularly in environments where users may engage with gaming or virtual item trading platforms. Monitoring for connections to 104.21.6.136 or related subdomains is recommended, as the infrastructure may be reused for additional malicious activity. No evidence currently links this domain to broader malware distribution or command-and-control operations, but its persistence in threat intelligence feeds suggests ongoing abuse.