calderacapitalgroup[.]xyz

Analysis of calderacapitalgroup.xyz, first observed on July 18 2025, shows that the domain is currently offline but was previously associated with a generic phishing campaign. The site resolved to the IP address 188.114.96.3, which belongs to AS13335 operated by Cloudflare, Inc., placing the host in the United States. No TLS certificate was presented, and the HTTP response returned the page title "Just a moment…", a pattern often observed on Cloudflare‑protected landing pages that serve as a brief interstitial before redirecting to malicious content. The domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com, and the registration record lists a single nameserver.

Trust‑scoring services provide conflicting signals: Gridinsoft assigned a score of 0 / 100, while Scamadviser reported 40 / 100, indicating low confidence in the domain’s legitimacy. VirusTotal scans flagged the domain in 2 of 95 security engines, and the domain appears on one known phishing blocklist, currently blocked by PhishDestroy. The limited detection footprint, combined with the lack of SSL and the generic page title, suggests a short‑lived phishing infrastructure rather than a persistent service.

Uncertainty remains regarding the exact phishing vector, targeted brands, or credential‑harvesting forms, as no additional content analysis is available. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for re‑use of the underlying Cloudflare IP range, and consider adding the domain to internal blacklist feeds. Ongoing observation of the registrar and hosting provider for future registrations with similar characteristics is recommended.