casibom-girisimmyni[.]vip

Analysis of casibom-girisimmyni.vip shows a recently created domain (registered February 21, 2026 via NiceNIC International Group Co., Limited) that is currently taken offline and returns HTTP 403. The authoritative name servers are newt.ns.cloudflare.com and wren.ns.cloudflare.com, indicating the domain is behind Cloudflare’s network (ASN 13335, United States). DNS resolution points to IP 188.114.96.3, which belongs to Cloudflare and is covered by the Google Trust Services / WE1 SSL certificate, confirming TLS termination at the CDN edge. The page title observed during a brief fetch is “Hawkins & Clarke | Global Asset Recovery Division”, a plausible corporate name often abused in credential‑harvesting campaigns.

The site employs jsDelivr, Cloudflare Browser Insights, and HTTP/3, typical of infrastructure used to host malicious pages while blending with legitimate traffic. Security telemetry shows the domain appears on one public blocklist and is flagged by PhishDestroy. VirusTotal analysis reports that five of ninety‑three scanning engines have identified the domain as malicious, contributing to its elevated risk rating. Additionally, Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious classification.

While the offline status limits immediate exposure, the combination of a recent registration, corporate‑looking page title, Cloudflare edge hosting, and multiple security detections strongly supports a phishing attribution. The exact malicious payload or credential‑collection mechanism cannot be confirmed because the page content has not been captured beyond the title. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑appearance, and add the IP address to threat‑intel feeds. Continuous re‑scanning is advised to capture any future changes in content or detection status.