casibom-guncelqiris[.]vip

The domain casibom-guncelqiris.vip is presently active and has been classified as a generic phishing site with a high risk rating. Registration occurred on 26 June 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. DNS resolution points to 104.21.21.155, an address owned by Cloudflare (AS13335) and hosted in the United States. Both authoritative nameservers, arvind.ns.cloudflare.com and penny.ns.cloudflare.com, are Cloudflare‑managed, indicating the attacker is leveraging Cloudflare’s CDN and DDoS protection services. The site returns HTTP 200 and serves a TLS certificate issued by Google Trust Services under the WE1 label, confirming proper HTTPS deployment. The page title observed is “DDoS Koruma Doğrulaması”, which suggests the landing page is presenting a DDoS protection verification message, a common lure in phishing kits. Cloudflare Browser Insights and HTTP/3 are detected, further confirming the use of Cloudflare’s performance stack. The domain is listed on at least one security blocklist and has been flagged by PhishDestroy, while five of ninety‑one VirusTotal scanners have raised alerts, reinforcing the malicious assessment. Gridinsoft assigns a trust score of zero out of one hundred, indicating extreme suspicion. No additional payload, landing‑page content, or target brand information is available from the current dataset, leaving the precise phishing vector undocumented. Defenders should block network resolution to 104.21.21.155 for this hostname, add casibom-guncelqiris.vip to URL filtering and email‑security rules, and monitor for any outbound connections that may attempt to exfiltrate credentials through the domain. Continuous re‑assessment is advised, as further intelligence may reveal the specific credential‑capture methodology employed.