alpenncapital[.]com[.]pandoramarketlimited[.]com

Analysis indicates that alpenncapital.com.pandoramarketlimited.com was registered through NameCheap on May 19 2025. The authoritative name servers ns1.megatronserver.com and ns2.megatronserver.com resolve the domain to IP 198.12.93.82, which is assigned to AS36352 HostPapa and geolocated in the United States. The site presented a TLS certificate issued by Let’s Encrypt (certificate identifier E7), confirming that HTTPS was available when the domain was active. The page title returned by the HTTP response was “Alpenn Capital – Home”, suggesting an attempt to impersonate a financial entity, though the content has not been examined.

The domain is currently offline, and its hosting provider has taken it down. Reputation services have flagged the domain: PhishDestroy lists it as blocked, and it appears on one additional security blocklist. VirusTotal scans show three of ninety‑five antivirus engines flagging the domain, and Gridinsoft assigns a trust score of zero out of one hundred, indicating a high likelihood of malicious use. No further technical artifacts such as malware payloads, phishing kits, or compromised credentials have been observed.

The limited public visibility prevents a full determination of the phishing campaign’s scope, target audience, or payload. Defensive teams should continue to block the domain at perimeter defenses, add the domain and its resolving IP address to URL filtering and threat intelligence feeds, and monitor for any related subdomains or similar naming patterns. Because the domain is already taken offline, incident response can focus on preventing re‑use of the same infrastructure and on correlating any user reports that reference the same brand name or page title.