capitalcraftltd[.]com

Analysis of www.capitalcraftltd.com shows a newly registered domain that is actively being used for credential‑harvesting phishing. The domain was created on 28 January 2026 and is registered through Dynadot Inc. Infrastructure profiling reveals that the domain resolves to IP 199.250.205.89 and is served by two distinct name‑server pairs: ns1.hostgain.xyz, ns2.hostgain.xyz and ns1.servconfig.com, ns2.servconfig.com. The presence of multiple authoritative name‑servers from different providers suggests an attempt to increase resilience against takedown efforts. The domain appears on one security blocklist and has been explicitly blocked by the PhishDestroy feed, indicating that at least one anti‑phishing organization has observed malicious activity associated with the host.

VirusTotal has recorded scans from 91 vendors, none of which have generated a detection at the time of analysis; this lack of detections does not constitute evidence of safety and should be interpreted as a gap in current coverage. No public SSL certificate details, HTTP response codes, or page‑title information are currently available, limiting the ability to assess transport‑layer security or content cues. Consequently, the precise phishing lure and targeted brand remain unverified.

Defenders should add the domain and its IP address to internal blocklists, monitor DNS queries for the listed name‑servers, and enforce outbound traffic controls to prevent credential submission to the host. Continuous re‑scanning with multi‑vendor services is advised, as detection coverage may evolve. Incident response teams should treat any user‑reported interactions with www.capitalcraftltd.com as potentially compromised and initiate credential reset procedures.