castigan[.]us

Analysis indicates that the domain castigan.us is actively engaged in credential harvesting operations, classified as a high-risk phishing threat. Registered on April 7, 2026, through Sav.com LLC, the domain resolves to the IP address 66.85.46.240, hosted under AS393960 by Host4Geeks LLC in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (cheryl.ns.cloudflare.com and logan.ns.cloudflare.com), a common tactic to obscure hosting origins and evade takedowns. The domain presents a valid SSL certificate issued by Let's Encrypt, which, while enhancing perceived legitimacy, is frequently exploited in phishing campaigns to bypass browser security warnings.

As of July 24, 2026, the domain returns an HTTP 200 status, suggesting an operational phishing page, though the specific content and targeted brand remain unconfirmed due to the absence of detailed page analysis. Detection metrics indicate moderate but growing awareness within the security community: 21 of 91 security vendors on VirusTotal flag the domain as malicious, while AlienVault OTX lists it in one threat intelligence pulse. Additionally, the domain appears on one security blocklist, and Gridinsoft assigns a trust score of 0/100, reinforcing its classification as high-risk. The registrar, Sav.com LLC, has been associated with domains involved in previous phishing campaigns, though no direct attribution to a specific threat actor or group is established.

The hosting provider, Host4Geeks LLC, operates within a known range for bulletproof hosting, which may contribute to the domain's persistence. Defenders are advised to block the domain and its resolving IP at the network level, monitor for related infrastructure (e.g., subdomains or newly registered domains under the same registrar), and correlate logs for connections to 66.85.46.240.