forexcapitals10.com — Phishing Investigation Report

The domain forexcapitals10.com, registered through Gname.com Pte. Ltd. on May 08, 2026, is currently identified as a high-risk generic phishing site. The domain has been flagged by several security vendors, including PhishDestroy, MetaMask, and SEAL, indicating that it poses a significant threat to users. Infrastructure analysis reveals that the domain is hosted by CloudFlare, Inc., with nameservers amy.ns.cloudflare.com and cleo.ns.cloudflare.com, and resolves to the IP address 188.114.97.3, located in Canada. The SSL certificate is issued by Google Trust Services, which may give a false sense of security to unsuspecting users. Analysis of the domain's presence in threat intelligence platforms shows that it has been included in one threat intelligence pulse on AlienVault OTX and appears on three security blocklists, further corroborating its malicious nature. The page title 'FXcapKyn' suggests a deliberate attempt to mimic a legitimate financial service, potentially to deceive users into providing sensitive information. As of July 12, 2026, the domain remains active and accessible, with an HTTP status code of 200. Defenders should be vigilant and implement strict access controls to prevent users from accessing this domain. Network administrators are advised to monitor traffic for any connections to 188.114.97.3 and block them to mitigate the risk of data theft. Additionally, users should be educated on the signs of phishing and encouraged to verify the authenticity of financial websites before entering any personal or financial information. While the domain has been flagged by a minority of security vendors on VirusTotal, this does not diminish the overall risk, as it is still actively being used for phishing and has a low Gridinsoft trust score of 0/100. Comprehensive monitoring and proactive measures are essential to prevent potential breaches.