capitalgridxchange[.]online

capitalgridxchange.online was registered on March 07, 2025 and is presently taken offline. DNS resolution points to the IPv4 address 64.28.236.18, which is hosted by Shock Hosting LLC under ASN AS395092 in the United States. The domain’s registrar is listed as HOSTINGER operations, UAB. The only visible page title, “capitalgridxchange | Welcome to capitalgridxchange”, suggests a self‑hosted landing page without reference to a legitimate brand, indicating a generic financial‑themed lure rather than a targeted impersonation of a known service.

Security telemetry assigns the domain a Gridinsoft trust score of 0 / 100, and it appears on a single external blocklist. VirusTotal analysis shows that 2 of 93 scanned engines flagged the domain, providing limited but corroborating evidence of malicious intent. The site is also listed as blocked by PhishDestroy, and the SSL certificate is rated R12, reflecting a low‑trust security posture. While the limited detection count and solitary blocklist entry suggest a low‑profile operation, the combination of a recently created domain, low trust score, and multiple vendor detections aligns with patterns observed in generic phishing campaigns.

The precise phishing vector—whether credential harvesting, malware delivery, or other fraudulent activity—remains unverified because no additional content or behavioral data has been disclosed. Defenders should maintain the domain and its associated IP on internal blocklists, enforce network‑level filtering to prevent client connections, and monitor the hosting ASN for any re‑activation or related domains. Further analysis of archived HTTP responses, certificate chains, and any associated URLs could uncover additional indicators of compromise and aid in attributing the campaign to a broader threat actor infrastructure.