castondo[.]com

This domain, castondo.com, is an active credential harvesting phishing site designed to steal user login credentials through deceptive login portals. Analysis indicates the site mimics legitimate authentication pages, likely targeting financial, cryptocurrency, or email accounts. The infrastructure employs evasion techniques, including Cloudflare proxying and HTTP/3, to obscure its malicious activity and resist takedown efforts. Infrastructure analysis reveals the domain was registered on June 07, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with phishing operations. Security vendors have flagged the domain in 3 out of 95 VirusTotal engines, while it appears on 4 independent security blocklists, including cryptocurrency-specific threat feeds. AlienVault OTX records the domain in 4 distinct threat intelligence pulses, further corroborating its malicious classification. The SSL certificate, issued by Google Trust Services, and the presence of HSTS headers suggest an attempt to appear legitimate while masking the true origin of the attack. Users who have visited castondo.com or entered credentials on the site should immediately revoke access to any potentially compromised accounts, particularly those linked to financial services or cryptocurrency wallets. Enable multi-factor authentication on all critical accounts and monitor for unauthorized transactions or login attempts. If credentials were submitted, assume they are compromised and rotate passwords across all platforms where the same or similar credentials were used. Network administrators should block the domain at the DNS or proxy level to prevent further exposure within their environments.