web[.]edl-capital-ag[.]com

This domain is flagged for hosting a phishing infrastructure specifically designed to impersonate EDL Capital, a financial services entity. Analysis indicates the threat type as credential harvesting and financial fraud, categorized under generic phishing with an elevated risk level. The domain remains offline but was actively used to deceive targets into disclosing sensitive login credentials or financial information. Infrastructure analysis reveals the domain was registered through Tucows Domains Inc. on April 08, 2026, an atypical creation date suggesting potential domain spoofing or backdating. It resolved to IP address 104.21.26.19, a Cloudflare-associated endpoint commonly exploited for anonymity. Security vendors on VirusTotal flagged the domain at 5/95 detections, while independent trust scoring platforms assigned Gridinsoft and Scamadviser scores of 0/100 and 16/100, respectively. The domain appears on two security blocklists and is actively blocked by PhishDestroy and OISD. SSL certification was provided by Google Trust Services, a legitimate but frequently abused certificate authority for malicious domains. Mitigation requires immediate blacklisting of the domain and its associated IP 104.21.26.19 across all network security controls, including firewalls, email gateways, and endpoint protection systems. Security teams should conduct retrospective log analysis for connections to this domain or IP, prioritizing systems with financial or authentication-related functions. User awareness training should emphasize verification of domain legitimacy, particularly for financial communications, and encourage reporting of suspicious URLs. Given the domain's offline status, monitoring for re-registration or DNS reactivation is recommended, alongside proactive hunting for related infrastructure using the seed identifier fd8ae8.