maicapital1[.]com

This domain, maicapital1.com, is flagged for brand impersonation targeting users of the Across protocol and Crypto.com platform. Analysis indicates the site presents itself as a legitimate self-custodial wallet under the title 'Crypto.com Onchain: A Self-custodial Wallet from Crypto.com,' designed to deceive victims into disclosing wallet credentials or transferring cryptocurrency to attacker-controlled addresses. No explicit drainer kit signatures were identified in initial scans, though the infrastructure and page content strongly suggest credential harvesting or asset diversion intent. Infrastructure analysis reveals the domain was registered on January 9, 2025, through Gname.com Pte. Ltd. and resolves to the IP address 104.19.223.17. Detection metrics show 0/95 detections on VirusTotal, indicating no antivirus engines currently flag the domain as malicious. However, it appears on two security blocklists, including PhishDestroy and OISD. The site employs a Google Trust Services SSL certificate and utilizes multiple technologies, including Node.js, React, Next.js, and Amazon Web Services, which may facilitate rapid deployment and evasion of detection. As of the latest assessment, maicapital1.com has been taken offline, reducing immediate exposure risk. However, the domain remains registered, and the infrastructure could be reactivated or repurposed. Users who interacted with the site prior to takedown should assume potential credential or asset compromise and take immediate remedial action, including revoking wallet permissions, rotating passwords, and monitoring for unauthorized transactions. Network-level blocking of the IP 104.19.223.17 is recommended for proactive defense.