app[.]capitaunion[.]xyz

app.capitaunion.xyz was registered on 21 February 2026. The domain is presently taken offline, and its removal was confirmed by the phishing mitigation service PhishDestroy, which also placed the domain on its blocklist. Independent security blocklists reference the domain once, indicating limited exposure. VirusTotal analysis shows that 9 of 93 scanned security engines flagged the domain as malicious, reflecting a consensus of elevated risk despite the relatively low detection count.

The detection signatures primarily correspond to generic phishing heuristics, consistent with the classified threat type. No additional infrastructure details such as hosting IP, ASN, or SSL certificate information are publicly disclosed in the available intelligence. The limited presence on security blocklists, with only a single external list referencing the domain, suggests that detection was primarily driven by automated phishing detection services rather than widespread reporting. The domain's offline status prevents direct retrieval of page content, page title, or SSL certificate details, leaving the precise lure employed by the campaign unknown.

Consequently, analysts cannot confirm whether the site attempted credential harvesting for a specific brand or employed a generic login prompt. The detection count of nine vendors, while modest, aligns with the classification of elevated risk and warrants inclusion in organizational threat intelligence feeds. Defenders should continue to monitor for any re‑activation of the domain, enforce existing blocklist entries, and incorporate the domain identifier into email and URL filtering rules. Recommendations include updating URL reputation databases, deploying sink‑hole monitoring for any potential resurrection of the domain, and reviewing recent email traffic for links containing the sub‑domain pattern "app." that may indicate reuse of the same naming convention.