capsulux[.]ca

Analysis of capsulux.ca indicates a high‑risk generic phishing campaign that remains active as of July 12, 2026. The domain was registered on December 22, 2025 through Go Daddy Domains Canada, Inc, and is protected by a Let’s Encrypt R12 SSL certificate. An HTTP request returns status 200 and the page title "Not Acceptable!", which suggests the site is currently serving content that triggers a block. The site is listed on a security blocklist and has been flagged by PhishDestroy. Infrastructure analysis shows the domain resolves to IP 192.185.175.119, a server located in the United States under the ownership of Oracle Corporation. The host runs Apache HTTP Server and a WordPress stack with MySQL, PHP, Yoast SEO, jQuery Mobile, jQuery, and jQuery Migrate. Reputation scoring from Gridinsoft rates the site at 0/100, and five of ninety‑one VirusTotal scanners have reported malicious indicators. The combination of a low trust score, active blocklist entry, and multiple vendor detections supports the classification as a phishing vector. Uncertainty remains regarding the exact payload or credentials targeted because the page content has not been captured. Defenders should block the domain at network perimeter controls, update DNS filtering policies, and monitor for any outbound connections to the associated IP. Continuous scanning and inclusion in internal threat intel feeds are recommended to maintain visibility as the campaign evolves.