forexcapitals2[.]com

The domain forexcapitals2.com is identified as a generic phishing threat specifically targeting forex trading platforms. Analysis confirms the domain is currently offline, though it previously hosted fraudulent financial services infrastructure designed to deceive users into disclosing sensitive credentials or transferring funds. No direct brand impersonation has been confirmed, but the site mimics common forex trading interfaces to exploit trust in financial markets. Infrastructure analysis reveals critical indicators of compromise. The domain was created on May 8, 2026, and is registered through Gname.com Pte. Ltd. It resolves to the IP address 188.114.96.3, hosted behind CloudFlare infrastructure in Canada. Security vendors flagged this domain as malicious, with 9 of 95 VirusTotal engines detecting it as a threat. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. The SSL certificate is issued by Google Trust Services under the WE1 intermediate, a common tactic to lend superficial legitimacy to phishing sites. The page title, FXcapKyn, does not correspond to any known legitimate financial service, further indicating its fraudulent nature. Current status indicates the domain has been taken offline, likely due to enforcement actions or hosting provider intervention. However, threat actors frequently migrate phishing infrastructure to new domains or IPs. Organizations and individuals are advised to block the domain and its associated IP at the network perimeter. Financial institutions should monitor for references to forexcapitals2.com in transaction metadata or user reports. End users should verify the legitimacy of any forex trading platform through official channels and avoid entering credentials or financial details on untrusted sites. Security teams are recommended to review logs for connections to 188.114.96.3 or related domains registered through Gname.com Pte. Ltd. for signs of compromise.