cmdxcapital[.]org

The domain cmdxcapital.org was registered on March 11 2026 through Hostinger operations UAB. DNS resolution points the name to the IPv4 address 198.251.89.82, which belongs to AS53667 operated by FranTech Solutions and is geolocated in the United States. The host does not present an SSL/TLS certificate, so any traffic would be unencrypted HTTP. Authoritative nameservers listed are ns115.asurahosting.com, ns115.my-control-panel.com, ns116.asurahosting.com, and ns116.m, indicating deployment on a shared hosting platform. Gridinsoft rates the domain with a trust score of 0 out of 100, reflecting a high confidence of malicious intent.

VirusTotal analysis shows three out of ninety‑four scanners flagging the domain, and AlienVault OTX includes the indicator in two separate threat‑intel pulses. The domain is currently listed on three public blocklists, specifically PhishDestroy, MetaMask, and SEAL. The page title retrieved from the live endpoint reads “CMDX Capital – Safe investment with CMDX Capital”, which aligns with the reported generic phishing classification, although the page body has not been captured for further verification. The risk level is recorded as elevated, and the site status is offline at the time of reporting, limiting immediate victim exposure.

However, the underlying IP address and hosting infrastructure remain active, allowing the actor to redeploy the site or use the same resources for other campaigns. Uncertainties remain regarding the exact phishing kit employed and any credential‑harvesting mechanisms, as no detailed page content is available. Defenders should block DNS resolution for cmdxcapital.org, add 198.251.89.82 to IP deny lists, monitor the associated nameservers for re‑registration, and continue periodic re‑scanning of the domain to detect any re‑appearance. Monitoring of AS53667 traffic for anomalous patterns is also recommended.