capitalswestpoint[.]onnetw[.]com

Analysis of capitalswestpoint.onnetw.com shows a brand‑impersonation infrastructure targeting Google users through a tech‑support scam. The domain was registered on February 21, 2026 and resolves to the IP address 107.173.193.235, which is hosted in the United States under AS36352 (HostPapa). The TLS certificate presented is identified as R11, and the site’s page title reads “Welcome to Westpoint Capital | WestPoint Capitals,” which does not reference the targeted brand, indicating that the page’s visual content has not been disclosed. The domain is currently offline, having been taken down after detection. It appears on a single security blocklist and has been flagged by PhishDestroy.

Reputation scoring from Gridinsoft assigns a zero‑point trust rating (0/100). VirusTotal scans show three of ninety‑three security vendors reporting malicious activity, confirming that at least a subset of scanners recognize the domain as a threat. The threat level is classified as elevated. Defenders should immediately block the domain and its associated IP address at perimeter firewalls and DNS filtering solutions.

Email gateways should be configured to flag any messages containing references to the domain or the “Westpoint Capital” title. Continuous monitoring of the hosting provider (HostPapa) for new domains that resolve to the same IP range is advised, as the actor may re‑host future campaigns. Since the site’s internal content has not been publicly analyzed, threat‑intel teams should treat any newly observed page elements with heightened suspicion and prioritize sandbox analysis if the site reappears. Updating threat‑feed subscriptions to include the domain’s hash and associated indicators will help ensure rapid detection of any resurgence.