# PhishDestroy domain threat record: capitalotr.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/capitalotr.com/
Machine-readable companion: https://phishdestroy.io/domain/capitalotr.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-26 16:19:25 UTC
- Last availability or vendor check: 2026-10-26 16:38:37 UTC
- Stored record updated: 2026-10-26 20:12:20 UTC
- VirusTotal detections in the stored snapshot: 1/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: signal

## Stored infrastructure

- Observed IP address: 104.21.41.228
- Registrar in stored WHOIS data: Realtime Register B.V.
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-10-23 15:28:45 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a17912-2785-7426-8522-eca7aa9ccc15/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/capitalotr.com
- Certificate Transparency search: https://crt.sh/?q=%25.capitalotr.com
- Web Archive lookup: https://web.archive.org/web/*/https://capitalotr.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
The captured screenshot from 2026-10-26 shows a CAPITAL COMMODITIES branded trading page with a Masuk/Daftar button, a MAXIMIZE PROFIT - MINIMIZE RISK banner, a periksa detilnya prompt, and tiles for Opsi, Spot, Kontrak, Staking, Deposit and Penarikan. PhishDestroy classified the domain as a fake crypto exchange, first seen on 2026-10-26.

How the scam works
The page placed deposit and withdrawal entry points next to trading and staking offers, nudging visitors to register and fund an account on an unverified platform. As a category risk, fake exchanges of this kind take deposits and login details while presenting fabricated balances and profit claims.

Evidence
The screenshot shows the CAPITAL COMMODITIES logo, a Masuk/Daftar login and register button and Deposit and Penarikan tiles, while page metadata described a Capital Trading Platform promising a safe and reliable trading experience. urlScan scored 100 overall and 98 from its ML engine, categorising the page as phishing with generic and cryptoscam brand labels on 2026-10-26; MetaMask, SEAL and PhishDestroy blocklists listed the domain and OTX carried 4 pulses. VirusTotal did not flag it as malicious, with alphaMountain.ai marking it suspicious, while Google Safe Browsing and the Spamhaus DBL did not flag it on 2026-10-26. A capture on 2026-10-24 followed a 307 redirect from HTTP to HTTPS; site inspection recorded a UniApp and webpack stack with TradingView globals, 65 tracker requests, and 10 distinct script SHA256 hashes for pivoting, the first beginning 6f68e68ad06a.

Infrastructure
Notable weaknesses lead the posture: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP and CORP all absent; TLS 1.3, TLS_AES_256_GCM_SHA384, forward secrecy, ALPN h2; no SPF, DKIM or DMARC recorded; CAA present; DNSSEC unsigned. Registration records list Realtime Register B.V. as registrar with creation date 2026-10-23, and capture records dated 2026-10-26 show Cloudflare as the CDN with its WAF detected.

What to do
If you submitted credentials on capitalotr.com, change that password wherever you reused it and enable two-factor authentication; if you deposited funds, stop further transfers and report the loss. If you connected a wallet, disconnect it and revoke its connections and token approvals. Defenders should block capitalotr.com at proxy, DNS and mail gateways and hunt for the recorded script hashes in their logs.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17912-2785-7426-8522-eca7aa9ccc15/
Cloudflare Radar report: https://radar.cloudflare.com/scan/162140a8-4b0b-441c-aee0-4a819027dedf
URLQuery report: https://urlquery.net/report/be9f7da8-0b1a-41c7-923c-fbb508f2a746
Stored capture screenshot: https://urlscan.io/screenshots/01a17912-2785-7426-8522-eca7aa9ccc15.png
Cloudflare Radar screenshot (2026-10-26T16:30:38Z): https://screenshots.phishdestroy.io/cf/162140a8-4b0b-441c-aee0-4a819027dedf.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/be9f7da8-0b1a-41c7-923c-fbb508f2a746.png
URLScan screenshot (2026-10-24T16:43:48Z): https://screenshots.phishdestroy.io/us/01a16eca-831b-716f-8bd3-1fda4a5852dc.png
URLScan capture report: https://urlscan.io/result/01a16eca-831b-716f-8bd3-1fda4a5852dc/
VirusTotal report: https://www.virustotal.com/gui/domain/capitalotr.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=capitalotr.com
Revoke token approvals: https://revoke.cash/
Report crypto fraud (Chainabuse): https://www.chainabuse.com/report
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 20:12:20 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a17912-2785-7426-8522-eca7aa9ccc15.png
  Captured: 2026-10-26 16:38:37 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a17912-2785-7426-8522-eca7aa9ccc15.png
  Captured: 2026-10-26 16:38:37 UTC
  Source report: https://urlscan.io/result/01a17912-2785-7426-8522-eca7aa9ccc15/
- URLScan · 2026-10-24: https://screenshots.phishdestroy.io/us/01a16eca-831b-716f-8bd3-1fda4a5852dc.png
  Captured: 2026-10-24 16:43:48 UTC
  Source report: https://urlscan.io/result/01a16eca-831b-716f-8bd3-1fda4a5852dc/
  SHA-256: d812012ab84154380a29179be8fb43841851d6f18150cc8af9df9529229803b3
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/162140a8-4b0b-441c-aee0-4a819027dedf.png
  Captured: 2026-10-26 16:30:38 UTC
  Source report: https://radar.cloudflare.com/scan/162140a8-4b0b-441c-aee0-4a819027dedf
  SHA-256: 92d4115629a15d9bebaab71a75b76d87a3c51b91ce68c1cb7f1f7e7dfa5cfaab
- URLQuery: https://screenshots.phishdestroy.io/uq/be9f7da8-0b1a-41c7-923c-fbb508f2a746.png
  Source report: https://urlquery.net/report/be9f7da8-0b1a-41c7-923c-fbb508f2a746
  SHA-256: 2c384384dd1cdf40954607e9201b7f8199422e1f6712d048a85c705bb1f38833

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T17:05:06Z",
        "uuid": "01a17912-2785-7426-8522-eca7aa9ccc15",
        "scanned_at": "2026-10-26T16:36:56Z",
        "final_url": "https://capitalotr.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://capitalotr.com/",
                "from": "http://capitalotr.com/",
                "status": 307
            }
        ],
        "ip": "104.21.41.228",
        "domains": [
            "esch20.oss-ap-southeast-1.aliyuncs.com",
            "echang-bucket.oss-accelerate.aliyuncs.com",
            "cdn.dcloud.net.cn"
        ],
        "ips": [
            "47.79.49.183",
            "47.254.186.189",
            "104.21.41.228"
        ],
        "asns": [
            "45102",
            "13335"
        ],
        "countries": [
            "SG",
            "DE"
        ],
        "doc_hash": "6d855af7abe8a82fc8e8814359058d05f42248669c7c1f9e3f2ef895d5cb9013",
        "script_hashes": [
            "6f8e68ad06adb780cc5c453fa8bca624b03f84ba755d74d1f95d4dd620f21cc8",
            "f2c44cc64e435625951d5c4d5bed95fc5395628240110dcd1b567a0332892aa7",
            "b717778950e2ed5dd15c3d709922590eeebb60abcc49988456e472ac37bb2e2e",
            "1d0eddc7940d4c2f1919b72ba09457f448028dea2f3693bfae7c22f8e57393f9",
            "a4c681628f4c39d8f0c7ae17d61cbde54513e89d5b6ba24ebad3a7bd188b3628",
            "9d45b68d33de21a1fd26ab02426e66daceb33f4bc3c7451b7b3ca3c7310025c4",
            "84a8af8cb616902def23d928810a68231ee5808a2909c18ea8367daa80ea8c75",
            "f313f66de268b9495919fded3d4c9a519847545aae73def9c9f6b2408f52e947",
            "a6ef66c55241507b5455d2e8c46908730428a2a4130ac171d2445177d21491ae",
            "25cff6f2f23329b3d4fac06c8bb47be9b5df7115958402685a66fe1bd6443c38"
        ],
        "globals": [
            "coverSupport",
            "TradingView",
            "webpackChunkmy_project",
            "__uniConfig",
            "__uniRoutes",
            "UniApp",
            "UniViewJSBridge",
            "UniServiceJSBridge",
            "uni",
            "wx",
            "getApp",
            "getCurrentPages",
            "regeneratorRuntime",
            "setImmediate",
            "clearImmediate",
            "Buffer",
            "PubSub"
        ],
        "storage_keys": [
            "__DC_STAT_UUID",
            "langType"
        ],
        "tls": {
            "san": [
                "*.capitalotr.com",
                "capitalotr.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "capitalotr.com",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-21T16:37:18Z",
            "valid_from": "2026-10-23T16:37:19Z"
        },
        "domain_age_days": 1,
        "apex_age_days": 1,
        "tls_age_days": 2,
        "tls_valid_days": 89,
        "requests": 109,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 98,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "generic",
                    "cryptoscam"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Generic",
                    "Crypto Scam"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T16:33:16Z",
        "uuid": "162140a8-4b0b-441c-aee0-4a819027dedf",
        "scanned_at": "2026-10-26T16:30:38Z",
        "final_url": "https://capitalotr.com/",
        "status": 200,
        "history": [
            {
                "url": "https://capitalotr.com/",
                "status": 200
            }
        ],
        "dom_hash": "7e41be2ff4bf24a6d7180e55a2b5985dceb5834b3f050ead9cc16009b79bb42b",
        "doc_hash": "123956f39e2ccc34c6e7044f4427ca9bab14e7da0c435fe1c6cf8f32f1a572e9",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks",
            "New Domains"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "capitalotr.com",
                "type": "A",
                "value": "172.67.195.151"
            },
            {
                "name": "capitalotr.com",
                "type": "A",
                "value": "104.21.41.228"
            },
            {
                "name": "capitalotr.com",
                "type": "AAAA",
                "value": "2606:4700:3030::6815:29e4"
            },
            {
                "name": "capitalotr.com",
                "type": "AAAA",
                "value": "2606:4700:3035::ac43:c397"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.195.151",
        "whois": {
            "registrar": "Realtime Register B.V.",
            "created": "2026-10-23T17:28:45Z",
            "updated": "2026-10-23T17:31:48Z",
            "expires": "2027-10-23T17:28:45Z",
            "nameservers": [
                "pat.ns.cloudflare.com",
                "piers.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T17:30:59Z",
        "analysis_at": "2026-10-26T11:57:21Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 0,
            "suspicious": 1,
            "undetected": 36
        },
        "detections": {
            "alphaMountain.ai": "suspicious"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Suspicious (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "newly registered websites"
        },
        "registrar": "Realtime Register B.V.",
        "created": "2026-10-23T17:28:45Z",
        "expires": "2027-10-23T17:28:45Z",
        "updated": "2026-10-23T17:31:48Z",
        "first_seen": "2026-10-23T17:45:13Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3030::6815:29e4"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "piers.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.41.228"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.195.151"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3035::ac43:c397"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "pat.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "pat.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-26T12:38:12Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.capitalotr.com",
                "capitalotr.com"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "6226e6c70d5e32b90263a9e51c0ee1eef33",
            "sha256": "8692991d3d2f598c14ac0876e66d6317665e388215bb2ab1ed0d540929e50eca",
            "subject": "capitalotr.com",
            "valid_to": "2027-01-21T16:37:18Z",
            "valid_from": "2026-10-23T16:37:19Z"
        },
        "whois": {
            "registrar": "Realtime Register B.V.",
            "registrar_iana_id": "839",
            "registrar_url": "http://www.realtimeregister.com",
            "created": "2026-10-23T17:28:45Z",
            "updated": "2026-10-23T17:31:48Z",
            "expires": "2027-10-23T17:28:45Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "pat.ns.cloudflare.com",
                "piers.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "add period"
            ],
            "events": {
                "expiration": "2027-10-23T17:28:45Z",
                "last changed": "2026-10-23T17:31:49Z",
                "registration": "2026-10-23T17:28:45Z",
                "registrar expiration": "2027-10-23T17:28:45Z",
                "last update of RDAP database": "2026-10-23T17:45:03Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T16:37:37Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "capitalotr.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-26T16:29:46Z",
            "first": "2026-10-26T16:29:46Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 2500
        },
        "robots_txt": {
            "agents": [
                "*",
                "Amazonbot",
                "Applebot-Extended",
                "Bytespider",
                "CCBot"
            ],
            "present": true
        },
        "social_tags": {
            "title": "Capital Trading Platform",
            "ogType": "website",
            "robots": "all",
            "ogImage": "./static/platform/capital/logoBg.png?1792777696481",
            "ogTitle": "Capital Trading Platform",
            "keywords": "Capital",
            "ogSiteName": "Capital Trading Platform",
            "themeColor": "#ffffff",
            "description": "Professional digital currency trading platform, safe and reliable trading experience",
            "twitterCard": "summary_large_image",
            "ogDescription": "Professional digital currency trading platform, safe and reliable trading experience"
        },
        "trackers": {
            "requests": 65
        },
        "mixed_content": {
            "upgrade_insecure": true,
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 28,
                "tls": 49,
                "wait": 371,
                "connect": 8,
                "download": 0
            },
            "response_ms": 456
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 4316,
            "co2_grams": 0.0002,
            "cleaner_than": 90
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.192.139",
                    "host": "pat.ns.cloudflare.com"
                },
                {
                    "ip": "162.159.44.16",
                    "host": "piers.ns.cloudflare.com"
                }
            ],
            "zone": "capitalotr.com"
        },
        "location": {
            "ip": "2606:4700:3030::6815:29e4",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "capitalotr.com"
        },
        "dns": {
            "A": [
                "172.67.195.151",
                "104.21.41.228"
            ],
            "NS": [
                "pat.ns.cloudflare.com",
                "piers.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"pat.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418339429, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2606:4700:3030::6815:29e4",
                "2606:4700:3035::ac43:c397"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3035::ac43:c397",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://capitalotr.com"
            ]
        },
        "whois": {
            "registrar": "Realtime Register B.V.",
            "created": "2026-10-23T17:28:45Z",
            "updated": "2026-10-23T17:31:48Z",
            "expires": "2027-10-23T17:28:45Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "pat.ns.cloudflare.com",
                "piers.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html"
            }
        }
    }
}
```