caseupdate-x[.]xyz

The domain caseupdate-x.xyz was registered on February 23, 2026 through Atak Domain Bilgi Teknolojileri A.Ş. and is hosted on the Atak Domain network (ASN 211401) in Turkey, resolving to IP 185.46.40.240. DNS resolution is provided by the name servers p1.atakdomain.com and p2.atakdomain.com. The site currently returns a parked page with the title “caseupdate-x.xyz | Domain Parked,” indicating that the primary landing page is not serving malicious content at the time of observation, and the domain is listed as offline.

Despite the parked state, the domain is still classified as a credential‑phishing vector, consistent with the observed scam type in threat intelligence feeds. SSL analysis shows a Sectigo Limited issued DV certificate (Sectigo Public Server Authentication CA DV R36), confirming that HTTPS is enabled and that the certificate was likely provisioned automatically for the parked page. Reputation data indicates that the domain appears on three security blocklists and has been blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans report six of ninety‑three vendors flagging the domain, further supporting the phishing designation.

The combination of a recent registration date, Turkish hosting, and inclusion on multiple blocklists suggests a short‑lived infrastructure typical of credential‑phishing campaigns that rely on rapid domain turnover. Uncertainty remains around the exact phishing payload or lure, as no landing page content beyond the parked placeholder has been captured. Defenders should continue to block the domain at network perimeter devices, update endpoint protection signatures to include the observed IP address and associated name servers, and monitor for re‑use of the same hosting provider or similar domain patterns (e.g., “caseupdate-*.xyz”).