capybobo[.]info

PhishDestroy identifies capybobo.info as a credential theft domain under active investigation, posing a significant risk to users through potential fake login forms and data harvesting. This domain attempts to impersonate legitimate services to trick users into surrendering sensitive credentials, with no current detections on VirusTotal despite clear malicious intent. The site is newly registered and lacks reputation, making it a high-risk candidate for credential harvesting operations.

Technical indicators reveal critical red flags: VirusTotal reports 2/95 detections, indicating no antivirus or security vendor has flagged the domain yet; it was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED; resolves to IP 104.21.17.131; obtained a Let's Encrypt SSL certificate; and was created on March 18, 2026. While no confirmed Google Safe Browsing (GSB) blocklist status or third-party blocklist count is available at this time, the combination of fresh registration, zero detections, and active hosting strongly suggests imminent malicious deployment.

Current status remains under investigation, with PhishDestroy actively monitoring for behavioral changes or additional threat intelligence. Immediate user action is required: block capybobo.info at the network and endpoint levels, avoid visiting the site, and report any observed credential theft attempts to relevant security teams. Remaining risk is high due to the domain’s low detection rate and fresh infrastructure, making proactive blocking essential to prevent credential compromise.