amplify-financial-capital[.]com

The domain amplify-financial-capital.com has been identified as a phishing resource targeting financial service users. Analysis indicates this is a generic credential harvesting campaign, currently marked as offline. No specific financial institution branding was confirmed, though the domain name suggests an attempt to mimic legitimate financial or investment platforms. Infrastructure analysis reveals the domain was registered on October 9, 2025, through GRANSY S.R.O D/B/A SUBREG.CZ. It resolves to the IP address 198.49.23.144 and employs a Google Trust Services SSL certificate. Detection metrics show the domain appears on one security blocklist, with a Gridinsoft trust score of 0/100. VirusTotal reports 2 of 95 security vendors flagging the domain as malicious. Technologies detected include Nginx, Google Cloud, OpenResty, HubSpot, HSTS, HTTP/3, and Google Cloud Storage. Current status indicates the domain has been taken offline, though residual risk may persist. Organizations and users are advised to block the domain and associated IP 198.49.23.144 at perimeter defenses. Financial institutions should monitor for unauthorized access attempts linked to this campaign. Users who may have interacted with the domain should reset credentials on legitimate financial platforms and enable multi-factor authentication where available.