capitalpaybank[.]sbs

Analysis of capitalpaybank.sbs indicates a high‑confidence banking phishing operation that was taken offline prior to the report date of July 23, 2026. The domain was registered on March 10, 2026 through Dynadot LLC and resolves to the IPv4 address 198.251.84.200, which is advertised as part of AS53667 FranTech Solutions located in the United States. The site presented a TLS certificate issued by Let’s Encrypt (R12), confirming the use of encrypted HTTPS connections. HTTP traffic was observed to negotiate HTTP/3, and the server responded with LiteSpeed, suggesting a modern web stack.

Front‑end assets were identified as Tailwind CSS, Alpine.js, jsDelivr, and the Smartsupp live‑chat widget, all of which are common components in phishing kits that aim to mimic legitimate banking portals. The page title returned "Home - Capital Pay Bank," aligning with the declared scam type of banking phishing. VirusTotal scans recorded 13 detections out of 95 security vendors, reinforcing the malicious classification. The domain appears on a single external blocklist and is actively blocked by PhishDestroy, indicating that defensive communities have recognized the threat.

Nameservers listed (ns5.asurahosting.com, ns5.my-control-panel.com, ns6.asurahosting.com, ns6.my-contro) are typical of low‑cost hosting providers and provide no additional reputation signals. No further public intelligence such as OTX references or Safe Browsing entries was available at the time of analysis. Defenders should continue to block the domain and associated IP address at network perimeter devices, update local blocklists with the observed nameservers, and monitor for derivative domains that reuse the same hosting infrastructure or TLS fingerprint. Ongoing surveillance of the AS53667 range is advised, as threat actors frequently rotate IP assets within the same autonomous system.