keycapitalsltd[.]org

Analysis of keycapitalsltd.org, which was taken offline prior to this assessment, indicates it was deployed as a phishing site. The domain was registered on 21 February 2026 and resolves to IP 198.12.80.250, an address owned by HostPapa (AS36352) located in the United States. The TLS certificate observed on the site is identified as R12, which is typical for newly‑issued certificates and provides no additional reputation benefit. The page title returned by the HTTP response is "keycapitalsltd", matching the domain name but offering no insight into a target brand or service.

The domain appears on one security blocklist and has been explicitly blocked by the PhishDestroy list, confirming that threat‑intel feeds have flagged it as malicious. VirusTotal scans show that three of ninety‑three scanning engines flagged the domain, reinforcing the suspicion of malicious activity despite the majority of engines remaining silent. No Safe Browsing, Open Threat Exchange, or registrar reputation data were supplied, and the HTTP status at the time of testing returned a non‑200 response as the site was offline, limiting the ability to collect payload or content samples. The combination of a recent registration, dedicated hosting on a shared provider, a custom SSL certificate, blocklist inclusion, and partial VirusTotal detections aligns with typical infrastructure patterns of phishing operators.

Uncertainty remains around the exact phishing campaign details, such as the impersonated brand, credential‑harvesting methods, and any associated command‑and‑control infrastructure, because no page content or network traffic was captured. Defenders should add the domain and its IP address to local deny lists, monitor for any future resolution to new IPs, and enforce strict outbound filtering for traffic to HostPapa AS36352 ranges.