excaptradefx[.]com

The domain excaptradefx.com was created on 08 April 2025 through the registrar Cosmotown, Inc. It resolves to the IPv4 address 163.61.188.222, which belongs to AS153568 NEW DHAKA HARDWARE and is geolocated in the United States. The authoritative name servers are dns1.lytehosting.com, dns2.lytehosting.com, dns3.lytehosting.com and dns4.lytehosting.com, indicating hosting on the LyteHosting platform. The site presented a TLS certificate issued by Let’s Encrypt (R13), confirming that HTTPS was available at the time of observation. A page title of “Excaptradefx‑ Home” was retrieved, but no further content analysis is available because the service was taken offline before a full crawl could be performed. Detection signals show that the domain is classified as a generic phishing site.

Google Safe Browsing lists it for social‑engineering risk, and one security blocklist (PhishDestroy) has already added it. VirusTotal scans returned 13 positive detections out of 95 scanners, reinforcing the malicious label. The hosting stack disclosed by passive fingerprinting includes LiteSpeed web server, Bootstrap, jQuery, GSAP, Slick and HTTP/3 support, all of which are common in fraudulent landing pages. MX records consist of a single entry pointing to excaptradefx.com itself, a pattern often used to enable spoofed email delivery. No additional evidence such as payload samples, credential‑stealing forms, or redirect URLs has been captured, leaving the exact phishing template unknown.

The current offline status prevents real‑time verification of the page’s content, but the accumulated indicators are sufficient to deem the domain high‑risk. Defenders should block excaptradefx.com at network perimeter and DNS layers, update internal URL filtering lists, and monitor for outbound connections to 163.61.188.222. Email security gateways should flag any messages claiming to originate from this domain, especially those leveraging the same MX configuration.