casvax[.]com

PhishDestroy identifies casvax.com as an active malicious domain engineered to impersonate Microsoft 365 login portals. The page prompts visitors to submit corporate email credentials, harvesting them for follow-on Business Email Compromise (BEC) campaigns. This domain was registered through Dynadot Inc on May 03, 2026, and currently resolves to 172.67.217.28. A Let’s Encrypt SSL certificate is in place, lending false legitimacy to the spoofed portal. This domain poses an elevated phishing risk: it is currently active, resolves to a Cloudflare IP (172.67.217.28), and is already flagged by 2 of 95 VirusTotal security vendors. The domain’s recent creation date (May 03, 2026) highlights the urgency for immediate blocking, as threat actors rapidly deploy such portals to harvest credentials before takedowns occur. The low detection rate underscores the sophistication of the page’s mimicry of Microsoft’s official login interface. If you visited casvax.com or entered any credentials, immediately change the password on all corporate and personal accounts that share the same email. Report the incident to your IT or security team and scan all connected devices for malware. Block the domain at your firewall and update your organization’s threat intelligence feeds to include casvax.com based on the indicators above.