global-capitalfx[.]com

Analysis of global-capitalfx.com shows that the domain was registered on 21 February 2026 through Dynadot Inc. The site presents a page title “global-capitalfx.com - Cryptocurrency trading platform”, which aligns with the classified scam type “Fake Exchange”. The domain resolves to the IP address 192.3.141.252, which belongs to the HostPapa hosting network (AS36352) located in the United States. The hosting provider and the use of Cloudflare with HTTP/3 suggest that the operators leveraged a widely‑available CDN to obscure the origin of the service. Reputation checks indicate a Gridinsoft trust score of 0 out of 100, and the site appears on at least one public security blocklist. VirusTotal scans returned six positive detections out of 93 submitted security vendors, confirming that multiple scanners flag the domain as malicious.

PhishDestroy has also listed the domain, and the SSL certificate is identified as rating “R10”, a low‑trust indicator. The site is currently taken offline, which may be the result of takedown actions or the operators shutting down the infrastructure. The primary threat vector is brand impersonation of x.com, an established brand in the cryptocurrency space. The domain’s page title and the “Fake Exchange” classification imply that the site was intended to lure victims into believing they were interacting with a legitimate trading platform, potentially to harvest credentials or funds.

However, the exact content of the landing page, the presence of credential‑capture forms, or any malicious payloads have not been publicly disclosed, leaving those details uncertain. Defenders should continue to block the domain at network perimeter and DNS layers, update detection signatures to include the observed IP address and SSL fingerprint, and monitor for any resurgence of the domain or similar registrations using the same registrar or hosting provider.