ms-capitals[.]com

Analysis of ms-capitals.com, first registered on 13 November 2025 through NiceNIC International Group Co., Limited, shows infrastructure consistent with a brand‑impersonation campaign targeting the foundation brand. The domain resolves to the Cloudflare address 172.67.207.136, located in the United States and announced by ASN 13335 (Cloudflare, Inc.). Nameservers listed are ashton.ns.cloudflare.com and sandra.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. No SSL certificate was observed for the domain, suggesting that HTTPS was not provisioned or that default Cloudflare TLS was not activated. VirusTotal reports three detections out of ninety‑five scanning engines, confirming that at least a minority of security vendors have identified the domain as malicious.

The domain appears on one security blocklist and has been actively blocked by the PhishDestroy mitigation service. Gridinsoft assigns a trust score of 0/100, reinforcing the low credibility of the site. The current operational status is offline, which may reflect takedown efforts or a temporary suspension by the hosting provider. Evidence points to a brand‑impersonation intent, yet the exact content of the site, page title, or any login fields have not been disclosed in the available intelligence.

Consequently, the precise phishing kit or payload remains unknown. Defenders should continue to block the domain at perimeter filters, add the associated IP address 172.67.207.136 to deny‑list rules, and monitor for newly registered domains that resolve to the same Cloudflare IP range or share the same registrar. Ongoing surveillance of Cloudflare‑hosted domains with similar naming patterns (e.g., the “ms‑capitals” prefix) is recommended, as threat actors frequently recycle infrastructure.