casibom-adrsgrdmm[.]vip

Analysis of the domain casibom-adrsgrdmm.vip shows a high‑risk generic phishing indicator. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is hosted behind Cloudflare’s network (AS13335) with the public address 104.21.64.245 located in the United States. DNS resolution uses Cloudflare nameservers newt.ns.cloudflare.com and wren.ns.cloudflare.com, and the site serves an SSL certificate issued by Google Trust Services (WE1), confirming proper TLS deployment. The web server responded with HTTP 521, a Cloudflare‑specific error indicating that the origin server is unavailable, a pattern often observed in malicious drop sites that rely on Cloudflare’s protection layer.

Technical fingerprints include the use of jsDelivr for content delivery and HTTP/3 support, both common in legitimate services but also adopted by threat actors to improve performance and evade detection. Gridinsoft assigned a trust score of 0 / 100, reflecting an extremely low reputation. VirusTotal scans reported 15 detections out of 91 AV engines, reinforcing the malicious assessment. The domain appears on a single public blocklist and is specifically listed by PhishDestroy, confirming active enforcement by at least one anti‑phishing organization.

The page title “Hawkins & Clarke | Global Asset Recovery Division” suggests an attempt to impersonate a professional recovery service, but no further content analysis is available. Because the site’s content has not been publicly archived, the exact phishing payload remains unknown, representing an uncertainty that defenders must treat conservatively. Given the combination of recent registration, low trust score, multiple AV detections, active blocklist listings, and the presence of a legitimate‑looking page title, security teams should block DNS resolution and HTTP traffic to casibom-adrsgrdmm.