casibom-ggirisyp[.]vip

The domain casibom-ggirisyp.vip was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is currently resolved to the Cloudflare‑owned address 172.67.190.64 (AS13335, United States). The site presents a HTTPS certificate issued by Google Trust Services under the WE1 root, confirming that TLS termination occurs at Cloudflare. An HTTP request returns a 403 status code, indicating that the front‑end is deliberately restricting access, a behavior often observed in phishing infrastructure that serves content only to specific user agents or after certain parameters are supplied. The page title returned by the server is “Hawkins & Clarke | Global Asset Recovery Division”, suggesting the campaign may be impersonating a financial‑recovery service to lure victims into disclosing personal or financial information.

VirusTotal analysis shows that 13 of 93 security vendors have flagged the domain as malicious, providing independent corroboration of its hostile intent. The domain is listed on one security blocklist and has been actively blocked by the PhishDestroy feed, reinforcing the consensus that it is part of an ongoing phishing operation. A Gridinsoft trust score of 0 / 100 further reflects a highly malicious reputation. Technical fingerprinting reveals the use of jsDelivr for script delivery, Cloudflare as the CDN and DNS provider, and support for HTTP/3, all typical of modern malicious hosting stacks.

The risk rating is high and the status remains active as of the report date (24 July 2026). While the exact phishing kit, targeted brand, or credential‑collection page has not been publicly disclosed, the combination of recent registration, low trust score, vendor detections, and blocklist presence indicates a credible threat. Defenders should add casibom-ggirisyp.vip to DNS‑based blocklists, enforce TLS inspection for traffic to 172.67.190.