casibom-girislerrrmiz[.]vip

This domain, casibom-girislerrrmiz.vip, was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is currently resolved to the Cloudflare edge address 188.114.97.3, announced by AS13335 Cloudflare, Inc. and geolocated to the United States. The site returns an HTTP 521 status, indicating that the origin server is refusing connections, a pattern often observed in phishing infrastructures that rely on Cloudflare front‑ends while keeping the backend hidden. TLS termination is performed with a certificate issued by Google Trust Services under the WE1 identifier, confirming the use of Cloudflare‑managed SSL.

Infrastructure analysis shows the domain is served via Cloudflare with HTTP/3 enabled and includes third‑party assets from jsDelivr, suggesting the use of external libraries to render the page. The authoritative nameservers are newt.ns.cloudflare.com and wren.ns.cloudflare.com, both standard Cloudflare delegations. A Gridinsoft trust score of 0 out of 100 and presence on at least one security blocklist further corroborate the malicious posture. PhishDestroy has already blocked the domain, and VirusTotal reports six of ninety‑three scanning engines flagging the host, reinforcing the high‑risk assessment.

The only visible page title is "Hawkins & Clarke | Global Asset Recovery Division," which does not correspond to any known legitimate brand and is typical of a fabricated corporate façade used in credential‑harvesting campaigns. No additional intelligence such as OTX tags or specific malware kits is available, leaving the precise phishing vector—whether a credential‑stealing form, malicious attachment, or redirect—uncertain. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the casibom-girislerrrmiz.vip label, and consider adding the associated IP 188.114.97.3 to reputation feeds.