castlystudio[.]net

This domain, castlystudio.net, is assessed as an elevated-risk phishing site specifically designed to impersonate a legitimate creators network platform. Analysis indicates the site employs social engineering tactics to deceive users into disclosing credentials or sensitive information, as evidenced by its Google Safe Browsing classification of SOCIAL_ENGINEERING. The infrastructure exhibits characteristics consistent with credential harvesting or fraudulent account creation schemes targeting content creators and digital entrepreneurs. Infrastructure analysis reveals multiple technical indicators supporting the phishing classification. The domain was registered on May 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.97.3 and is currently offline. Detection metrics include 1/95 security vendor flags on VirusTotal, a Gridinsoft trust score of 0/100, and a Scamadviser trust score of 11/100. The domain appears on two security blocklists (PhishDestroy and InversionDNS) and presents a page title of 'CASTLY — Creators Network.' Detected technologies include jQuery, HSTS, Google Hosted Libraries, Cloudflare Browser Insights, Cloudflare, and HTTP/3, suggesting an attempt to mimic legitimate platform functionality while leveraging content delivery networks for resilience. Mitigation steps for this specific threat type include immediate blocking of the domain and its associated IP address (188.114.97.3) at the network perimeter. Organizations should update security controls to flag domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED with creation dates in 2026, as this pattern aligns with known phishing campaigns. End-users should be educated on recognizing social engineering tactics, particularly those impersonating creator platforms, and instructed to verify domain authenticity before entering credentials. Security teams are advised to monitor for similar domains using the 'CASTLY' brand name or variations, as threat actors may deploy new infrastructure using the same impersonation theme.