app[.]capx[.]zone

This domain, app.capx.zone, is flagged as a high-risk phishing site based on multiple technical indicators and security vendor detections. Analysis indicates the domain was registered on November 19, 2025, through a registrar commonly associated with abusive domains, and it currently resolves to the IP address 198.18.0.201. The page title, 'Nur einen Moment…,' suggests targeting of German-speaking users, though the exact nature of the phishing content remains unconfirmed due to lack of direct analysis. The domain is actively blocked by at least one security provider and appears on one security blocklist, reinforcing its malicious classification. Infrastructure analysis reveals the use of Cloudflare, which is frequently leveraged to obscure hosting details and evade takedowns. The domain supports HTTP/3, a protocol choice that may complicate detection or interception efforts. Its SSL certificate is issued by Google Trust Services, a legitimate provider, which does not mitigate the domain's malicious intent but may contribute to evading user suspicion. VirusTotal reports that 5 out of 95 security vendors flag this domain, a detection rate consistent with active but not yet widely recognized threats. The domain's trust score is 0/100, a metric that aligns with its confirmed phishing classification. While the specific phishing kit or targeted brand is not identified in available data, the combination of technical indicators—including the German-language page title, Cloudflare obfuscation, and recent registration—supports its designation as a high-risk threat. Defenders should treat this domain as actively malicious and prioritize blocking at the DNS or network level. Additional monitoring for related infrastructure, such as sibling domains or shared IPs, is recommended to identify potential campaign expansion.