casibom90002[.]com

On 25 July 2026, an investigation was initiated for the domain casibom90002.com, which is classified as a generic phishing site. The domain was registered on 27 February 2026 through NiceNIC International Group Co., Limited and is presently taken offline, with the takedown attributed to the PhishDestroy blocklist. DNS resolution points to the IP address 104.21.12.107, hosted within Cloudflare’s network (AS13335) and geolocated to the United States. No SSL certificate is presented for the host, indicating that HTTPS was not configured at the time of capture.

The authoritative nameservers are craig.ns.cloudflare.com and elaine.ns.cloudflare.com, both belonging to Cloudflare’s DNS service. VirusTotal analysis returned 11 positive detections out of 93 scanned scanners, confirming that multiple security engines flagged the domain as malicious. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single external security blocklist. The HTTP response returned a page title of “Just a moment…”, but no further content was collected, and no additional indicators such as login forms or brand references have been disclosed.

Taken together, the available evidence indicates that casibom90002.com was actively used for phishing shortly after its registration and was subsequently disrupted by a community‑driven takedown effort. The lack of TLS, low trust rating, and multiple vendor detections suggest a low‑quality or rapidly deployed malicious infrastructure. Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the underlying IP address or associated Cloudflare‑hosted subdomains, and incorporate the observed detection signatures into endpoint and email security policies. Because the site is offline, further forensic collection is limited; future investigations should focus on any residual traffic patterns or credential harvesting artifacts that may have been captured before the takedown.