boaelitepay[.]xyz[.]capicreunion[.]com

The domain boaelitepay.xyz.capicreunion.com was registered on December 08, 2025 through Dynadot LLC and is currently taken offline. Infrastructure analysis shows it resolves to the IPv4 address 192.3.190.189, which is hosted by HostPapa (AS36352) in the United States. The authoritative nameservers are dns1.webproserver.com and dns2.webproserver.com, indicating the use of a third‑party DNS service rather than the registrar’s default. No SSL certificate was observed for the host, meaning the site served HTTP only and lacked transport‑layer encryption.

The page title returned by the server was "Home - BOA Elite Pay", which does not directly reference the targeted brand but the overall scam classification is listed as Brand Impersonation, with the intended victim brand identified as "foundation". VirusTotal scans flagged the domain in 18 of 95 security vendor engines, and the site appears on one external security blocklist. Gridinsoft assigned a trust score of 0 out of 100, and PhishDestroy has already blocked the domain. The combination of a recent registration date, low‑cost registrar, hosting on a shared provider, lack of TLS, and multiple vendor detections suggests a purpose‑built phishing infrastructure rather than a compromised legitimate site.

Uncertainty remains around the specific phishing kit or credential‑harvesting page content because the site has been taken offline and no visual capture is available. Defenders should continue to block the domain and its IP address at perimeter firewalls and DNS filtering solutions, monitor for any resurgence of the same hostnames or IP ranges, and audit outbound traffic for connections to HostPapa‑hosted assets that may be repurposed by the same threat actor. Additional scrutiny of DNS queries to dns1.webproserver.com and dns2.webproserver.com may reveal related malicious domains, and threat‑intel sharing platforms should be updated with the observed indicators of compromise to improve collective detection.