calderacapital[.]xyz

Analysis of calderacapital.xyz, as of July 24 2026, shows the domain is offline but retains a set of technical artifacts that align with a generic phishing operation. The site was registered on July 18 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the IPv6 address 2606:4700:3030::6815:f9f, which is hosted by Cloudflare (AS13335) in the United States. No TLS certificate is presented, indicating the site was served over plain HTTP when active. The page title returned by the server was "Attention Required!

| Cloudflare," a generic Cloudflare interstitial that often appears when traffic is blocked or challenged. Threat intelligence aggregators have flagged the domain: VirusTotal recorded detections from 2 of 95 security vendors, and a single security blocklist lists the domain as malicious. Additionally, Gridinsoft assigned a trust score of 0 out of 100, and PhishDestroy has already blocked the host.

The limited data set does not include Safe Browsing, Open Threat Exchange, or detailed payload analysis, so the exact phishing template, targeted brand, or credential collection method remains unknown. Defenders should treat the domain as hostile, ensuring that outbound connections to the listed IPv6 address are denied, adding the domain to corporate URL filtering and DNS sinkhole lists, and monitoring for any rapid re‑registration or new DNS records that could indicate a resurrection attempt. Continuous threat‑intel feeds should be consulted for any emerging indicators that expand on the current evidence.