autodiscover[.]elixirxcapital[.]com

Analysis of autodiscover.elixirxcapital.com as of July 25, 2026 shows a high‑risk, active generic phishing infrastructure. The domain is delegated to ns27.asurahosting.com and ns28.asurahosting.com, both hosted by Asura Hosting. Registration was completed through Global Domain Group LLC, a registrar known to host a variety of short‑lived malicious sites.

HTTP responses return a 307 redirect, a pattern often used to forward victims to credential‑harvesting pages while obscuring the final target. The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy service, confirming that at least one trusted phishing‑mitigation platform has identified it as malicious. VirusTotal scans have flagged the domain in three out of ninety‑one vendor engines, providing independent vendor corroboration of suspicious activity.

No additional public intelligence such as brand targeting, page title, or SSL certificate details have been published, leaving the exact phishing lure and victim profile undefined. Defenders should treat the domain as a confirmed phishing vector: block DNS resolution, add the domain to URL filtering policies, and monitor outbound traffic for connections to the associated nameservers. Continuous re‑evaluation is advised, as the limited blocklist presence suggests that the infrastructure may be evolving or may rely on fast‑flux techniques to evade broader detection.