vortexcapitalholdings[.]com

Analysis of vortexcapitalholdings.com shows a newly registered domain (creation date June 12, 2026) that is currently active and resolves to the IP address 172.67.204.123. The domain is hosted on Cloudflare infrastructure, as indicated by its authoritative nameservers amber.ns.cloudflare.com and mitchell.ns.cloudflare.com, and was registered through Hosting Concepts B.V. d/b/a Registrar.eu. It appears on one security blocklist and has been explicitly blocked by the PhishDestroy feed, suggesting that at least one trusted phishing mitigation source has identified it as malicious.

VirusTotal records indicate that the domain has been scanned by 91 security vendors, with none of the vendors flagging it as malicious at the time of the scan; this lack of detections should not be interpreted as evidence of safety, as the domain may employ evasion techniques or have not yet been observed in the wild. No public page title, brand target, or kit information is available, and no additional context such as SSL certificate details, HTTP response codes, or Safe Browsing status has been reported, leaving the exact payload or impersonated entity undefined. Defenders should proactively block DNS resolution to vortexcapitalholdings.com and add the associated IP 172.67.204.123 to network‑level deny lists, especially for outbound traffic from sensitive user groups.

Continuous monitoring of the domain’s DNS records and any future VirusTotal or blocklist updates is advised, as changes in detection status may indicate active exploitation. Organizations employing email security gateways should ensure that messages containing links to this domain are quarantined or rejected, and incident response teams should be prepared to investigate any credential‑theft attempts that reference the domain. Given the recent registration date and the presence on a phishing blocklist, the domain should be treated as a high‑confidence indicator of compromise until further evidence clarifies its threat scope.