casesupport-x[.]com

Analysis of the domain casesupport-x.com indicates it was actively employed in a social media phishing campaign targeting users of a major platform, as evidenced by the page title 'X. It’s what’s happening / X' and the explicit classification of 'Social Media Phishing' in threat intelligence sources. The domain was registered on February 23, 2026, through Web Commerce Communications Limited (WebNic.cc), a registrar frequently observed in phishing infrastructure. As of July 23, 2026, the domain resolves to the IP address 162.159.140.229, hosted on Cloudflare’s network (AS13335), a common tactic to obscure the true origin of malicious content and leverage Cloudflare’s proxy services for anonymity. The domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, suggesting detection by multiple independent threat intelligence platforms.

A VirusTotal scan conducted prior to takedown flagged the domain by one of ninety-three security vendors, though the absence of additional detections does not preclude malicious intent. No SSL certificate was present, which may have triggered browser warnings and reduced the campaign’s effectiveness. The domain’s nameservers, keanu.ns.cloudflare.com and zoe.ns.cloudflare.com, further confirm the use of Cloudflare’s DNS infrastructure. Infrastructure analysis reveals that casesupport-x.com was taken offline following detection, though the exact timeline of its operational phase remains unclear.

The lack of additional technical indicators, such as a known phishing kit or associated malware samples, limits further attribution. Defenders should treat this domain as confirmed malicious within the context of social media credential harvesting. Network security teams are advised to block the domain and its resolving IP (162.159.140.229) at perimeter defenses, monitor for related domains registered through WebNic.cc, and correlate logs for connections to this infrastructure.