capax[.]cl

The domain capax.cl was registered on May 14, 2026 and remains active as of the report date. Automated classification assigns it a high‑risk generic phishing label. HTTP requests to the host return a 406 status code, a pattern frequently employed to disrupt generic crawlers while presenting a tailored page to targeted victims.

Infrastructure analysis reveals that capax.cl resolves to IP address 69.6.225.73, an address located in Chile and associated with Oracle Corporation network assets. The service presents a valid TLS certificate issued by Let’s Encrypt (R13), enabling encrypted connections that may lend legitimacy to the phishing page. The domain is listed on three public blocklists and carries a Gridinsoft trust score of 0 / 100, confirming its reputation as malicious.

Threat intelligence corroborates the malicious profile. AlienVault OTX references the domain in a single pulse, and three independent blocklists have recorded it. VirusTotal scans show that three out of ninety‑five security vendors flag the domain, suggesting partial detection and highlighting the possibility of additional undetected capabilities given the recent registration date. The limited vendor count does not diminish the high‑risk rating.

Defensive recommendations include immediate DNS blocking of capax.cl and the addition of its resolved IP 69.6.225.73 to network deny lists. Monitoring outbound TLS connections for the specific Let’s Encrypt certificate fingerprint can provide early alerts of attempted access. Where possible, sinkholing the domain or redirecting traffic to a safe landing page will disrupt the phishing campaign. Continuous re‑evaluation is advised as further indicators may surface.