app[.]atlas-capi[.]com

Analysis of app.atlas-capi.com indicates this domain was associated with a generic phishing infrastructure targeting users of a CFD trading platform. The domain was registered on July 21, 2025, through Cosmotown, Inc., and resolved to the IP address 198.12.66.123, hosted on AS36352 (HostPapa) in the United States. The page title, 'Atlas Capital | Advanced CFD Platform for Trading Global Assets,' suggests an attempt to impersonate a financial trading service, though no specific brand confirmation or kit identification is available from the provided data. Infrastructure review reveals the domain used nameservers ns1.host-forest.com and ns2.host-forest.com, a pattern observed in other low-reputation hosting setups.

No SSL certificate was detected, increasing the likelihood of interception or lack of encryption. The domain appeared on at least one security blocklist and was flagged by PhishDestroy. Gridinsoft assigned a trust score of 0/100, reflecting high-risk classification. As of July 24, 2026, the domain is offline, though prior detections by two of 95 security vendors on VirusTotal further support its malicious classification.

Defenders should treat this domain as part of a phishing campaign targeting financial services users. The absence of SSL, recent creation date, and low detection coverage indicate a likely short-lived operation. While the exact content of the site remains unanalyzed, the combination of page title, hosting provider, and detection status confirms its use in fraudulent activity. Organizations should block the domain and IP, monitor for related infrastructure, and alert users to potential CFD trading scams using similar branding.