comptroller[.]com-capsh[.]my

Analysis of comptroller.com-capsh.my indicates an active phishing domain targeting financial or corporate accounting systems. The domain was registered on June 12, 2026, and currently resolves to IP address 172.67.178.27, which is associated with a content delivery network provider commonly used to mask hosting origins. As of July 29, 2026, eleven out of ninety-one security vendors on VirusTotal have flagged this domain as malicious, and it appears on at least one security blocklist, including PhishDestroy.

The domain name incorporates the term 'comptroller', suggesting an attempt to impersonate official financial oversight or internal audit portals, though the exact brand or organization being mimicked remains unconfirmed due to lack of page content analysis. Infrastructure analysis reveals the domain uses a subdomain structure that may be intended to create a false sense of legitimacy by appending a recognizable term to a less familiar second-level domain. The use of a CDN-hosted IP further complicates attribution, as it obscures the true hosting provider and geolocation.

No SSL certificate details, HTTP response codes, or page titles are currently available for deeper assessment. Defenders should treat this domain as an elevated-risk indicator and consider blocking it at the network level, particularly in financial, corporate, or government environments where 'comptroller' portals are relevant. Further monitoring is recommended to track changes in detection status or hosting infrastructure, as this domain may evolve into a more targeted campaign.