decapitalmarket[.]com

Analysis of decapitalmarket.com indicates the site was registered on 21 February 2026 through Dynadot LLC. The authoritative nameservers 5014.ns1.abovedomains.com and 5014.ns2.abovedomains.com resolve the domain to the IPv4 address 185.254.196.61, which is allocated to Virtual Systems LLC (AS30860) in Ukraine. The hosting environment reports Apache HTTP Server and PHP, with client‑side libraries including jQuery, jQuery UI, a jQuery CDN, and Contentsquare, suggesting a typical web‑application stack. The TLS certificate presented is issued by Sectigo Public Server Authentication CA DV E36, confirming that encrypted transport was available while the site was online. VirusTotal records show that one of ninety‑five scanned security vendors flagged the domain, providing a single detection signal. The domain appears on a single external blocklist and is currently listed as blocked by PhishDestroy.

Independent reputation scoring from Gridinsoft assigns a trust rating of 0 out of 100, indicating an extremely low confidence level in the site’s legitimacy. The page title returned from the HTTP response is the string “mamma”, which does not correspond to any known brand or service and offers no contextual clues about the intended victim luring. The overall risk assessment is elevated. While the site is now taken offline, the combination of a recent registration date, low‑trust score, detection by a security vendor, and inclusion on a phishing‑focused blocklist strongly suggests the domain was used for a generic phishing campaign. The exact phishing template, target audience, or credential‑harvesting mechanism cannot be confirmed from the available data, and no additional threat‑intel feeds reference the domain.

Defenders should add decapitalmarket.com to internal blocklists and ensure that any outbound connections to the associated IP address 185.254.196.61 are denied.