forexcapitals16[.]com

This domain, forexcapitals16.com, is flagged as a high-risk generic phishing threat. It was registered on May 08, 2026, through Gname.com Pte. Ltd. and currently resolves to IP 172.67.142.11, which is hosted by Cloudflare, Inc. in Canada. The domain is still active and returns an HTTP 200 status, indicating the phishing page is live and accessible. The page title is 'FXcapKyn', which appears to impersonate a financial or cryptocurrency-related brand, though the exact brand being mimicked is not explicitly identified in the available intelligence. The domain uses nameservers amy.ns.cloudflare.com and cleo.ns.cloudflare.com, and its SSL certificate is issued by Google Trust Services with the identifier WE1. The Gridinsoft trust score is 0 out of 100, reflecting a high level of distrust. VirusTotal analysis shows 2 out of 95 security vendors flagging this domain as malicious, and it appears on 3 security blocklists. AlienVault OTX reports the domain is included in 1 threat intelligence pulse. The domain is blocked by PhishDestroy, MetaMask, and SEAL, confirming its association with phishing campaigns. What remains uncertain is the specific brand being targeted and the full scope of the phishing kit in use. Defenders should treat this domain as an active threat, block all traffic to it at network and email gateways, and monitor for any related domains or subdomains that may emerge. Users who have visited the site should be educated on phishing risks and advised to change any credentials that may have been entered. Given its recent registration and active status, this domain is likely part of an ongoing campaign that may expand to include additional infrastructure.