mobil30[.]casibom-resmigirisadresi[.]icu

This domain is flagged for hosting a credential harvesting phishing campaign targeting users through a deceptive address verification interface. Analysis indicates the site mimics a legitimate service portal, presenting a page titled 'Casibom - 🚨 Adres mi Kaçtı? Panik Yok, Gerçek Kapı Tam Burada' to trick users into submitting sensitive login credentials. The threat type is classified as generic phishing with an elevated risk level due to its targeted social engineering tactics and operational infrastructure. Infrastructure analysis reveals the domain mobil30.casibom-resmigirisadresi.icu resolves to the IP address 172.67.183.67, which is associated with a content delivery network known for obfuscating malicious endpoints. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on June 24, 2024, a registrar frequently observed in phishing operations due to its lax enforcement policies. Detection metrics show the domain is flagged by 4 out of 95 security vendors on VirusTotal, while a single security blocklist, PhishDestroy, has actively blocked access. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy to unsuspecting users. Mitigation against this threat requires immediate domain blacklisting at the network perimeter and endpoint levels. Organizations should update web filtering rules to block requests to 172.67.183.67 and domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED exhibiting similar naming patterns. User awareness training should emphasize the risks of credential submission on unverified address verification portals, particularly those using urgent or emotionally manipulative language. Security teams are advised to monitor for credential reuse attempts stemming from compromised accounts associated with this campaign.