caseflow-x[.]com

caseflow-x.com was registered through Hostinger Operations UAB on 23 February 2026. The domain uses Hostinger’s default parking nameservers ns1.dns-parking.com and ns2.dns-parking.com and resolves to the IPv4 address 84.32.84.32, which belongs to AS47583 Hostinger International Limited and is geolocated in Lithuania. No TLS certificate is presented; HTTP requests return a generic parked‑domain page whose title is “Parked Domain name on Hostinger DNS system”. The site has been classified as a social‑media phishing campaign and is listed on three public blocklists, with specific blocklist entries from PhishDestroy, MetaMask, and SEAL.

VirusTotal analysis shows that one of ninety‑three scanners raised a detection, reinforcing the malicious assessment. As of the report date the hosting appears to have been taken offline, and no active web service is reachable. The available evidence confirms the infrastructure is being used for credential‑harvesting targeting social‑media accounts, but the exact phishing lure, victim profile, and any associated command‑and‑control infrastructure remain unknown.

Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑activation of the IP address, and add the domain to internal IOC lists. Network traffic to 84.32.84.32 should be logged and inspected for anomalous patterns, and any user‑reported attempts to access the domain should be treated as malicious. Ongoing threat‑intel feeds should be consulted for potential redeployment of the same infrastructure under a different domain.