casibom-tkgirisadresi[.]vip

On July 24, 2026, the domain casibom-tkgirisadresi.vip was observed in active phishing operations targeting entities that might be interested in asset recovery services, as indicated by the page title “Hawkins & Clarke | Global Asset Recovery Division”. The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is served by Cloudflare’s DNS infrastructure (newt.ns.cloudflare.com, wren.ns.cloudflare.com). DNS resolution points to the IP address 172.67.129.229, which belongs to AS13335 Cloudflare, Inc., located in the United States. The site presents a valid TLS certificate issued by Google Trust Services under the WE1 intermediate, confirming that HTTPS connections are correctly encrypted. HTTP requests return a 521 status code, a Cloudflare‑specific error that typically indicates that the origin server is not responding, a pattern often observed in malicious short‑lived phishing sites.

Automated analysis by VirusTotal recorded detections from seven out of ninety‑three security vendors, confirming that multiple scanners flag the domain as malicious. In addition, the Gridinsoft trust score is 0 out of 100, and the domain appears on one external blocklist, with PhishDestroy explicitly blocking it. Technology fingerprinting identifies the use of jsDelivr and HTTP/3, both common in legitimate and malicious sites hosted behind Cloudflare. The limited number of blocklist appearances suggests that the campaign is relatively new or low‑profile.

Current open‑source intelligence does not reveal the exact payload, credential‑capture method, or target demographic beyond the generic asset‑recovery theme. Consequently, defenders should consider immediate network‑level blocking of the domain and its associated IP address, update intrusion‑detection signatures with the observed URL pattern and TLS fingerprint, and monitor for any future registration of similar domains by the same registrar.