xcapitalflow[.]com

Analysis indicates that the domain xcapitalflow.com was registered through DreamHost on July 16, 2025 and resolves to the IP address 198.251.83.106, which is routed through AS53667 (FranTech Solutions) in the United States. The site presented the page title “Xcapital Flow | Welcome to Xcapital Flow” and served an SSL certificate issued by Let’s Encrypt (R12). Although the site is currently taken offline, historical data show that it was flagged by multiple detection sources.

The domain appears on four security blocklists and is explicitly blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura. AlienVault OTX recorded the domain in a single threat‑intelligence pulse, and VirusTotal reported detections from two of ninety‑five scanning engines. The combination of recent registration, use of a free TLS certificate, and rapid inclusion on blocklists suggests a purpose‑built phishing operation, likely targeting users searching for financial services associated with the “Xcapital Flow” naming.

No additional content, such as login forms or credential‑capture pages, has been publicly disclosed, and the exact victim‑targeting vector remains unknown. Defenders should add the IP address 198.251.83.106 and the domain to internal block lists, monitor DNS queries for the associated nameservers (ns25.asurahosting.com, ns26.asurahosting.com), and consider raising alerts for any traffic that attempts TLS connections to the Let’s Encrypt certificate fingerprint observed for this host. Ongoing intelligence gathering is advised to determine whether the infrastructure is reused in future campaigns.