blockscapitals[.]ltd

blockscapitals.ltd was registered on July 13 2026 through Dynadot Inc and is hosted on the IP address 2.57.91.184. The domain resolves using the Aurora and Nebula parking name servers (aurora.dns‑parking.com, nebula.dns‑parking.com). VirusTotal records indicate that one of ninety‑one security vendors has flagged the domain, and it appears on a single external blocklist. PhishDestroy has already blocked the domain, and the internal status remains active with a high risk rating.

No additional public data such as SSL certificates, HTTP response codes, page titles, or brand targeting have been released, so the exact phishing payload or lure is currently unknown. The limited detection footprint suggests the campaign is in an early stage or using minimal exposure to avoid rapid takedown. Defenders should add 2.57.91.184 to network deny lists, monitor DNS queries for blockscapitals.ltd, and enforce URL filtering based on the observed blocklist entry. Continuous re‑scanning on multi‑engine platforms is recommended to capture any future detections.

Because the registrar is Dynadot, a request for domain suspension can be escalated through the registrar’s abuse channel if malicious activity is confirmed. Organizations should also review any recent user reports that reference the domain to correlate potential credential‑harvesting attempts. Ongoing intelligence collection is required to determine the phishing template, target audience, and any associated command‑and‑control infrastructure.