alpha-capitals[.]org

Analysis of alpha-capitals.org indicates a confirmed brand impersonation campaign targeting Google, classified with an elevated risk level. The domain, registered on April 19, 2025, through Atak Domain Bilgi Teknolojileri A.Ş., currently resolves to IP address 192.3.141.251, hosted on AS36352 (HostPapa) in the United States. No SSL certificate was detected, increasing the likelihood of interception or manipulation of unencrypted traffic. The domain is served by nameservers ns1.anitahost.com and ns2.anitahost.com, which have been previously associated with malicious infrastructure.

Detection metrics reveal low trust scores: Gridinsoft assigned a 0/100 trust rating, while Scamadviser rated it 1/100. The domain appears on one security blocklist and was flagged by 13 of 95 security vendors in VirusTotal scans. AlienVault OTX lists it in a single threat intelligence pulse, further corroborating its malicious classification. The page title, 'Home,' provides no additional context about the site's content or functionality, though the known scam type is explicitly labeled as brand impersonation.

As of the report date, the domain has been taken offline, though residual DNS records or cached entries may persist. Defenders should treat this domain as compromised and block it at the network level. Given the absence of SSL and the domain's association with known malicious hosting, any residual connections should be investigated for potential data exfiltration or credential harvesting attempts. The short operational window and swift takedown suggest a likely hit-and-run phishing operation, but historical logs should be reviewed for prior interactions.