casebavlle[.]com

This domain, casebavlle.com, is flagged as a phishing site targeting users of premium skin trading platforms through brand impersonation. Analysis indicates the site mimics legitimate gaming asset marketplaces, specifically promoting itself as an "innovative platform for true collectors of premium skins" in Russian. The fraudulent scheme likely aims to harvest user credentials, payment details, or deploy malicious scripts under the guise of virtual item trading. No direct evidence of a crypto drainer kit was identified, but the site’s structure aligns with credential theft and financial fraud tactics common in gaming-related phishing operations. Infrastructure analysis reveals multiple high-risk technical indicators. The domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with abusive registrations. It resolves to the IP address 172.67.186.201, which is part of a cloud hosting range known for transient malicious activity. VirusTotal detection shows 2 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and was previously identified in a threat intelligence pulse on AlienVault OTX. Google Safe Browsing status is not explicitly listed, but the domain’s offline status suggests prior blocking. The domain is currently offline, likely due to takedown actions or voluntary suspension following detection. However, residual risk remains elevated due to the domain’s recent creation, association with a high-risk registrar, and prior malicious hosting. Users who interacted with the site should immediately revoke any connected session tokens, reset credentials for linked accounts, and monitor financial transactions for unauthorized activity. Organizations should update blocklists to include this domain and its resolved IP to prevent future access attempts. Continuous monitoring of related infrastructure is recommended, as threat actors may re-deploy similar schemes under new domains.