casibomgiris2o26[.]com

The domain casibomgiris2o26.com is identified as a credential theft operation specifically targeting Russian-speaking users through fraudulent real estate registration services. Analysis indicates the site masqueraded as a legitimate property agency offering permanent Moscow residency registration, a common social engineering tactic to harvest personal identification documents and login credentials. Currently, the domain is offline, though its infrastructure and historical activity warrant continued monitoring. Infrastructure analysis reveals multiple high-risk indicators. The domain resolves to IP address 45.10.243.69 and was registered on April 28, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently associated with malicious domains. Security vendors have flagged this domain in 5 of 95 VirusTotal scans, while AlienVault OTX lists it in one threat intelligence pulse. The site appears on one security blocklist (PhishDestroy) and receives a trust score of 0/100 from Gridinsoft. Notably, the domain employs DDoS-Guard, a service often used to obscure hosting origins, and uses a Let's Encrypt SSL certificate, which provides encryption but does not validate legitimacy. Given the elevated risk profile, users who interacted with this domain should take immediate action. Credentials or personal documents submitted to this site should be considered compromised, necessitating password resets and identity monitoring. Network administrators are advised to block the domain and associated IP (45.10.243.69) at the firewall level. Organizations should also review logs for connections to this infrastructure, particularly from Russian-language regions. While currently offline, domains of this nature frequently re-emerge under similar names, requiring vigilance for variants using the same social engineering theme.