# PhishDestroy domain threat record: capitalotu.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/capitalotu.com/
Machine-readable companion: https://phishdestroy.io/domain/capitalotu.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-26 16:20:21 UTC
- Last availability or vendor check: 2026-10-26 16:40:48 UTC
- Stored record updated: 2026-10-26 19:30:32 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: signal

## Stored infrastructure

- Observed IP address: 188.114.96.3
- Registrar in stored WHOIS data: Realtime Register B.V.
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-10-23 15:28:45 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a17914-2a5a-77c1-beb0-1c00d8342768/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/capitalotu.com
- Certificate Transparency search: https://crt.sh/?q=%25.capitalotu.com
- Web Archive lookup: https://web.archive.org/web/*/https://capitalotu.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
The captured page is a mobile landing screen showing a CAPITAL COMMODITIES logo, a hamburger menu and a Masuk/Daftar button, above a dark gold-candlestick banner reading SMARTER TRADING • BETTER DECISIONS, a KYC and 2FA notice with a periksa detailnya button, Opsi, Spot, Kontrak and Staking tiles, and Deposit and Penarikan actions. PhishDestroy listed the domain under its Fake Exchange classification after intake reasoning flagged the Capital Trading Platform branding as fraudulent-investment style; it was first seen on 2026-10-26, three days after registration on 2026-10-23.

How the scam works
As a fake exchange page, it invites Indonesian-speaking crypto traders to register or sign in through Masuk/Daftar while presenting Deposit and Penarikan controls alongside legitimacy claims about KYC and 2FA. The category risk is that credentials, identity documents or funds submitted through such a freshly launched platform are captured by an operator the visitor cannot verify, regardless of the polished trading dashboard layout.

Evidence
The screenshot itself shows the Capital Commodities impersonation, deposit/withdrawal tiles and the login form field. URLScan captured the domain on 2026-10-24 with a malicious verdict, and its 2026-10-26 scan returned an engine score of 98 and an overall score of 100 categorised as phishing with Generic and Crypto Scam brand tags, following a 307 redirect from http to https. Cloudflare Radar on 2026-10-26 labelled it phishing with newly seen domain risks, while VirusTotal returned 0 detections of 92 engines, Google Safe Browsing was not flagged, and external blocklists showed 0 entries on 2026-10-26; PhishDestroy's internal blocklist is true and OTX recorded 3 pulses. The page returned HTTP 200 with 20 tracker requests recorded by Webcheck.

Infrastructure
The domain was registered on 2026-10-23 through Realtime Register B.V. and resolves through Cloudflare nameservers pat.ns.cloudflare.com and piers.ns.cloudflare.com, with recorded A records 188.114.96.3, 188.114.97.3, 172.67.160.57 and 104.21.90.194 under CloudFLARENET. Traffic is proxied by Cloudflare, so these addresses do not identify the operator. TLS is a Let's Encrypt certificate valid from 2026-10-23 to 2027-01-21 covering capitalotu.com and its wildcard, DNSSEC is unsigned, and no HSTS header is served.

What to do
If you entered credentials or personal data, stop using the site, change any reused passwords, enable two-factor authentication on affected accounts, and contact your exchange or bank to monitor for unauthorised activity. Do not send funds to addresses or deposits requested through this page. For defenders, block capitalotu.com and its Cloudflare-hosted assets, monitor for lookalike Capital Commodities domains, and treat absence from Google Safe Browsing or VirusTotal as inconclusive rather than safe.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17914-2a5a-77c1-beb0-1c00d8342768/
Cloudflare Radar report: https://radar.cloudflare.com/scan/b7af2e27-b982-455c-aba1-b4ecac72afb8
URLQuery report: https://urlquery.net/report/dd523ce2-4e4a-4aff-b8ca-579d7fe9faa8
Stored capture screenshot: https://urlscan.io/screenshots/01a17914-2a5a-77c1-beb0-1c00d8342768.png
Cloudflare Radar screenshot (2026-10-26T16:30:09Z): https://screenshots.phishdestroy.io/cf/b7af2e27-b982-455c-aba1-b4ecac72afb8.png
VirusTotal report: https://www.virustotal.com/gui/domain/capitalotu.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=capitalotu.com
Revoke token approvals: https://revoke.cash/
Report crypto fraud (Chainabuse): https://www.chainabuse.com/report
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 17:38:20 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a17914-2a5a-77c1-beb0-1c00d8342768.png
  Captured: 2026-10-26 16:40:48 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a17914-2a5a-77c1-beb0-1c00d8342768.png
  Captured: 2026-10-26 16:40:48 UTC
  Source report: https://urlscan.io/result/01a17914-2a5a-77c1-beb0-1c00d8342768/
- URLScan · 2026-10-24: https://screenshots.phishdestroy.io/us/01a16e14-ca10-71ca-a8dd-520eb3b494bd.png
  Captured: 2026-10-24 13:23:48 UTC
  Source report: https://urlscan.io/result/01a16e14-ca10-71ca-a8dd-520eb3b494bd/
  SHA-256: c8a3c2ad4ce65aad7f0bf6a59737302ebf6e818b292f072dedf0968f90380a23
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a17920-4c10-77ca-b10b-fb339708b723.png
  Captured: 2026-10-26 16:52:16 UTC
  Source report: https://urlscan.io/result/01a17920-4c10-77ca-b10b-fb339708b723/
  SHA-256: 3c62055e3a94b59bddf4df708f111f9a36f032cd104b40d00c8d1e1bd1933071
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/b7af2e27-b982-455c-aba1-b4ecac72afb8.png
  Captured: 2026-10-26 16:30:09 UTC
  Source report: https://radar.cloudflare.com/scan/b7af2e27-b982-455c-aba1-b4ecac72afb8
  SHA-256: 58e0274d1b9077237067081915f75490593281a2343db8e78fa36a2c747ef40a
- URLQuery: https://screenshots.phishdestroy.io/uq/dd523ce2-4e4a-4aff-b8ca-579d7fe9faa8.png
  Source report: https://urlquery.net/report/dd523ce2-4e4a-4aff-b8ca-579d7fe9faa8
  SHA-256: 57c62cc1e3ed4802fd5dac84551a29487da0e1ffba625e83a1f8c66424377305

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T17:04:26Z",
        "uuid": "01a17914-2a5a-77c1-beb0-1c00d8342768",
        "scanned_at": "2026-10-26T16:40:36Z",
        "final_url": "https://capitalotu.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://capitalotu.com/",
                "from": "http://capitalotu.com/",
                "status": 307
            }
        ],
        "ip": "188.114.97.3",
        "domains": [
            "esch20.oss-ap-southeast-1.aliyuncs.com",
            "echang-bucket.oss-accelerate.aliyuncs.com",
            "cdn.dcloud.net.cn"
        ],
        "ips": [
            "47.79.49.183",
            "47.254.186.189",
            "188.114.97.3"
        ],
        "asns": [
            "45102",
            "13335"
        ],
        "countries": [
            "SG",
            "DE"
        ],
        "doc_hash": "6d855af7abe8a82fc8e8814359058d05f42248669c7c1f9e3f2ef895d5cb9013",
        "script_hashes": [
            "6f8e68ad06adb780cc5c453fa8bca624b03f84ba755d74d1f95d4dd620f21cc8",
            "f2c44cc64e435625951d5c4d5bed95fc5395628240110dcd1b567a0332892aa7",
            "b717778950e2ed5dd15c3d709922590eeebb60abcc49988456e472ac37bb2e2e",
            "1d0eddc7940d4c2f1919b72ba09457f448028dea2f3693bfae7c22f8e57393f9",
            "a4c681628f4c39d8f0c7ae17d61cbde54513e89d5b6ba24ebad3a7bd188b3628",
            "9d45b68d33de21a1fd26ab02426e66daceb33f4bc3c7451b7b3ca3c7310025c4",
            "84a8af8cb616902def23d928810a68231ee5808a2909c18ea8367daa80ea8c75",
            "f313f66de268b9495919fded3d4c9a519847545aae73def9c9f6b2408f52e947",
            "a6ef66c55241507b5455d2e8c46908730428a2a4130ac171d2445177d21491ae",
            "25cff6f2f23329b3d4fac06c8bb47be9b5df7115958402685a66fe1bd6443c38"
        ],
        "globals": [
            "coverSupport",
            "TradingView",
            "webpackChunkmy_project",
            "__uniConfig",
            "__uniRoutes",
            "UniApp",
            "UniViewJSBridge",
            "UniServiceJSBridge",
            "uni",
            "wx",
            "getApp",
            "getCurrentPages",
            "regeneratorRuntime",
            "setImmediate",
            "clearImmediate",
            "Buffer",
            "PubSub"
        ],
        "storage_keys": [
            "__DC_STAT_UUID",
            "langType"
        ],
        "tls": {
            "san": [
                "*.capitalotu.com",
                "capitalotu.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "capitalotu.com",
            "protocol": "QUIC",
            "valid_to": "2027-01-21T16:33:42Z",
            "valid_from": "2026-10-23T16:33:43Z"
        },
        "domain_age_days": 2,
        "apex_age_days": 2,
        "tls_age_days": 3,
        "tls_valid_days": 89,
        "requests": 140,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 98,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "generic",
                    "cryptoscam"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Generic",
                    "Crypto Scam"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T16:33:14Z",
        "uuid": "b7af2e27-b982-455c-aba1-b4ecac72afb8",
        "scanned_at": "2026-10-26T16:30:09Z",
        "final_url": "https://capitalotu.com/",
        "status": 200,
        "history": [
            {
                "url": "https://capitalotu.com/",
                "status": 200
            }
        ],
        "dom_hash": "7e41be2ff4bf24a6d7180e55a2b5985dceb5834b3f050ead9cc16009b79bb42b",
        "doc_hash": "fec35b8a08ec47f777e9dece66fe11d1a5b3e41e260d82b12e101d8fcf023f2f",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks",
            "New Domains"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "capitalotu.com",
                "type": "A",
                "value": "172.67.160.57"
            },
            {
                "name": "capitalotu.com",
                "type": "A",
                "value": "104.21.90.194"
            },
            {
                "name": "capitalotu.com",
                "type": "AAAA",
                "value": "2606:4700:3035::ac43:a039"
            },
            {
                "name": "capitalotu.com",
                "type": "AAAA",
                "value": "2606:4700:3037::6815:5ac2"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.160.57",
        "whois": {
            "registrar": "Realtime Register B.V.",
            "created": "2026-10-23T17:28:45Z",
            "updated": "2026-10-23T17:30:19Z",
            "expires": "2027-10-23T17:28:45Z",
            "nameservers": [
                "pat.ns.cloudflare.com",
                "piers.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T17:01:24Z",
        "analysis_at": "2026-10-26T03:41:18Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 37
        },
        "reputation": 0,
        "registrar": "Realtime Register B.V.",
        "created": "2026-10-23T17:28:45Z",
        "expires": "2027-10-23T17:28:45Z",
        "updated": "2026-10-23T17:30:19Z",
        "first_seen": "2026-10-23T18:20:39Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::6815:5ac2"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "piers.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "pat.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.90.194"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3035::ac43:a039"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "pat.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.160.57"
            }
        ],
        "dns_at": "2026-10-26T15:08:14Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.capitalotu.com",
                "capitalotu.com"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "5230b5bb74be8d2f0843b36a0f3742541a1",
            "sha256": "df1221af7a9008fbac46c90f5f3d9bdaff337407a13bb3d6343481bb487e0d3c",
            "subject": "capitalotu.com",
            "valid_to": "2027-01-21T16:33:42Z",
            "valid_from": "2026-10-23T16:33:43Z"
        },
        "whois": {
            "registrar": "Realtime Register B.V.",
            "registrar_iana_id": "839",
            "registrar_url": "http://www.realtimeregister.com",
            "created": "2026-10-23T17:28:45Z",
            "updated": "2026-10-23T17:30:19Z",
            "expires": "2027-10-23T17:28:45Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "pat.ns.cloudflare.com",
                "piers.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "add period"
            ],
            "events": {
                "expiration": "2027-10-23T17:28:45Z",
                "last changed": "2026-10-23T17:30:20Z",
                "registration": "2026-10-23T17:28:45Z",
                "registrar expiration": "2027-10-23T17:28:45Z",
                "last update of RDAP database": "2026-10-23T18:20:29Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T16:35:57Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "capitalotu.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-26T16:31:10Z",
            "first": "2026-10-26T16:31:10Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 2498
        },
        "robots_txt": {
            "agents": [
                "*",
                "Amazonbot",
                "Applebot-Extended",
                "Bytespider",
                "CCBot"
            ],
            "present": true
        },
        "social_tags": {
            "title": "Capital Trading Platform",
            "ogType": "website",
            "robots": "all",
            "ogImage": "./static/platform/capital/logoBg.png?1792777696481",
            "ogTitle": "Capital Trading Platform",
            "keywords": "Capital",
            "ogSiteName": "Capital Trading Platform",
            "themeColor": "#ffffff",
            "description": "Professional digital currency trading platform, safe and reliable trading experience",
            "twitterCard": "summary_large_image",
            "ogDescription": "Professional digital currency trading platform, safe and reliable trading experience"
        },
        "trackers": {
            "requests": 20
        },
        "mixed_content": {
            "upgrade_insecure": true,
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 84,
                "tls": 101,
                "wait": 400,
                "connect": 77,
                "download": 1
            },
            "response_ms": 663
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 4316,
            "co2_grams": 0.0002,
            "cleaner_than": 90
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.35.16",
                    "host": "piers.ns.cloudflare.com"
                },
                {
                    "ip": "173.245.58.139",
                    "host": "pat.ns.cloudflare.com"
                }
            ],
            "zone": "capitalotu.com"
        },
        "location": {
            "ip": "2a06:98c1:3120::3",
            "asn": "13335",
            "org": "CloudFLARENET-EU",
            "city": "London",
            "country": "GB"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "capitalotu.com"
        },
        "dns": {
            "A": [
                "188.114.97.3",
                "188.114.96.3"
            ],
            "NS": [
                "piers.ns.cloudflare.com",
                "pat.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"pat.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418286035, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2a06:98c1:3121::3",
                "2a06:98c1:3120::3"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3121::3",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://capitalotu.com"
            ]
        },
        "whois": {
            "registrar": "Realtime Register B.V.",
            "created": "2026-10-23T17:28:45Z",
            "updated": "2026-10-23T17:30:19Z",
            "expires": "2027-10-23T17:28:45Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "pat.ns.cloudflare.com",
                "piers.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html"
            }
        }
    }
}
```