app[.]cloudcapitalinvest[.]com

The domain app.cloudcapitalinvest.com was registered on December 01, 2025 through Dynadot LLC and is currently listed as taken offline. Infrastructure analysis shows the domain resolves to the IP address 198.23.193.170, which belongs to HostPapa (AS36352) in the United States. The authoritative nameservers are dns1.geebytesdns.com and dns2.geebytesdns.com, indicating the use of a third‑party DNS service. No SSL certificate is present, and the web server responds with an HTTP 403 status code, suggesting that direct content retrieval is blocked or restricted. Detected web technologies include LiteSpeed, HTTP/3, YouTube embeds, and the Smartsupp live‑chat widget, all of which are consistent with a generic hosting environment rather than a specialized financial platform. The page title returned from the server is "cloudcapitalinvest - Home," which does not reference the targeted brand and provides no additional context about the site’s purpose.

Security vendors have flagged the domain on five of ninety‑five VirusTotal scanners, and the domain appears on a single external blocklist. PhishDestroy has actively blocked the domain, and Gridinsoft assigns a trust score of zero out of one hundred, reflecting a high likelihood of malicious intent. The threat classification is recorded as an investment scam that impersonates the brand "base," aligning with the broader category of brand impersonation. However, without live content the exact tactics used to lure victims remain uncertain.

Defenders should continue to monitor the IP address 198.23.193.170 for any future activation, enforce blocking at network perimeter and DNS layers, and add the domain to internal blocklists. Given the lack of TLS encryption, any attempted connections would be unencrypted and could be inspected for malicious payloads. Additional investigation, such as requesting historical snapshots from web archives, may reveal the original landing page and confirm the impersonation technique.