cold-cas[.]com

cold-cas.com has been identified as an active credential-harvesting domain. The site is currently operational and is being tracked under the generic phishing threat category by PhishDestroy. No specific brand impersonation has been confirmed at this stage, but the domain is actively engaging in deceptive tactics to lure victims. Investigations are ongoing to determine the exact lures and target organizations.

This domain was flagged by 6 of 95 VirusTotal vendors during the most recent scan, indicating it remains undetected by major security engines. It resolves to IP address 188.114.97.3 and utilizes a Let’s Encrypt SSL certificate for legitimacy signaling. The domain was registered through CNOBIN INFORMATION TECHNOLOGY LIMITED on March 11, 2026, and has not yet been added to any public blocklists. This lack of detection and absence from trust lists suggest a recently emerged threat with low historical scrutiny.

Given its current active status and low detection footprint, cold-cas.com poses a credible risk to end-users who may encounter it through phishing campaigns or misleading links. Immediate defensive actions are advised, including blocking the domain at the network perimeter and DNS level using the provided IP and domain indicators. Users should be warned via security awareness training to avoid interacting with unsolicited login prompts or form submissions linked to this domain. Further intelligence will be published as investigations progress.