# PhishDestroy domain threat record: freecapitalai.shop

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/freecapitalai.shop/
Machine-readable companion: https://phishdestroy.io/domain/freecapitalai.shop/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-27 01:17:59 UTC
- Last availability or vendor check: 2026-10-27 23:04:25 UTC
- Stored record updated: 2026-10-27 23:22:35 UTC
- VirusTotal detections in the stored snapshot: 17/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 172.67.148.179
- Registrar in stored WHOIS data: Dynadot Inc.
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-08-09 05:16:56 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0eced-a92c-70f1-b277-f6dd05db9443/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/freecapitalai.shop
- Certificate Transparency search: https://crt.sh/?q=%25.freecapitalai.shop
- Web Archive lookup: https://web.archive.org/web/*/https://freecapitalai.shop/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added freecapitalai.shop to its internal blocklist after VirusTotal flagged the domain with multiple malicious detections. The site was first seen by PhishDestroy on 2026-10-27 and returned an HTTP 200 response with the recorded title “Free Capital AI | a premium AI | Official Web Platform”.

How the scam works
The suspicious label indicates the domain could be used for deceptive purposes such as phishing or credential harvesting, but no specific malicious page elements were observed on the captured snapshot. Without concrete evidence of credential forms or malicious scripts, the risk remains a potential for deceptive content that might trick visitors.

Evidence
VirusTotal analysis on 2026-10-21 reported 14 malicious and 3 suspicious detections out of 92 engines, with vendors labeling the domain as phishing or malicious. Google Safe Browsing checked on 2026-10-27 did not flag the site. urlscan captured the site on 2026-09-29; its machine‑learning engine gave a malicious score of 99, though the overall verdict was clean. OTX listed one pulse referencing the domain as of 2026-10-27. PhishDestroy’s internal blocklist marks the domain as malicious, while external blocklists showed no entries on the same date.

Infrastructure
The domain was registered on 2026-08-09 through Dynadot Inc., giving it an age of 51 days at the time of capture. DNS records observed on 2026-10-21 listed Cloudflare nameservers and A records 172.67.148.179 and 104.21.29.88, indicating the use of Cloudflare’s CDN. The TLS certificate, issued by Google Trust Services, was recorded as valid from 2026-10-07 to 2027-01-05 for the freecapitalai.shop hostname.

What to do
Visitors should avoid entering credentials or downloading files and report the URL to security teams. Organizations should block the domain at the network perimeter and monitor logs for connections to the recorded IP addresses. If any credentials were submitted, change them immediately; no wallet‑related actions are required.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0eced-a92c-70f1-b277-f6dd05db9443/
Cloudflare Radar report: https://radar.cloudflare.com/scan/3aa595f3-b052-4c4f-976c-7ebc974bf0ff
Stored capture screenshot: https://urlscan.io/screenshots/01a0eced-a92c-70f1-b277-f6dd05db9443.png
URLScan screenshot (2026-09-28T13:00:24Z): https://screenshots.phishdestroy.io/us/01a0e81a-02bc-77d8-9649-3d04599974eb.png
URLScan capture report: https://urlscan.io/result/01a0e81a-02bc-77d8-9649-3d04599974eb/
VirusTotal report: https://www.virustotal.com/gui/domain/freecapitalai.shop
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=freecapitalai.shop
Archived copy: https://web.archive.org/web/20261027011922/https://freecapitalai.shop/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-27 01:20:23 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a0eced-a92c-70f1-b277-f6dd05db9443.png
  Captured: 2026-10-27 01:17:59 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0eced-a92c-70f1-b277-f6dd05db9443.png
  Captured: 2026-10-27 04:30:44 UTC
  Source report: https://urlscan.io/result/01a0eced-a92c-70f1-b277-f6dd05db9443/
- URLScan · 2026-09-28: https://screenshots.phishdestroy.io/us/01a0e81a-02bc-77d8-9649-3d04599974eb.png
  Captured: 2026-09-28 13:00:24 UTC
  Source report: https://urlscan.io/result/01a0e81a-02bc-77d8-9649-3d04599974eb/
  SHA-256: 1ed03ac90d5ef36215f6837a9e4031a2f787818dd6932e5f56efa35dc4d91ad3
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/3aa595f3-b052-4c4f-976c-7ebc974bf0ff.png
  Captured: 2026-10-27 01:19:01 UTC
  Source report: https://radar.cloudflare.com/scan/3aa595f3-b052-4c4f-976c-7ebc974bf0ff
  SHA-256: 2f45666022cef5544fe4c61f8d7596396d727e7bfde8524bfe08ce10fc8fba73

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-27T01:19:27Z",
        "uuid": "01a0eced-a92c-70f1-b277-f6dd05db9443",
        "scanned_at": "2026-09-29T11:30:01Z",
        "final_url": "https://freecapitalai.shop/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://freecapitalai.shop/",
                "from": "http://freecapitalai.shop/",
                "status": 307
            }
        ],
        "ip": "172.67.148.179",
        "domains": [
            "cdnjs.cloudflare.com",
            "cdn.jsdelivr.net",
            "fonts.googleapis.com",
            "static.cloudflare.com"
        ],
        "ips": [
            "2a04:4e42::485",
            "2a00:1450:4001:c1f::5f",
            "104.17.25.14",
            "172.67.148.179"
        ],
        "asns": [
            "54113",
            "15169",
            "13335"
        ],
        "countries": [
            "US",
            "DE"
        ],
        "doc_hash": "7c222aa3ae37bbe4b2cbec1ab97aa1119ce3a030fd00c3f3bd994868c82795a8",
        "script_hashes": [
            "ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142"
        ],
        "globals": [
            "requestResize",
            "LANG_MSGS",
            "ClientJS",
            "_mjkg8",
            "toggleTermsPopup",
            "__cfQR",
            "__cfRLUnblockHandlers",
            "__lgT0"
        ],
        "cookies": [
            "entry_url"
        ],
        "tls": {
            "san": [
                "freecapitalai.shop"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "freecapitalai.shop",
            "protocol": "QUIC",
            "valid_to": "2026-11-07T08:18:07Z",
            "valid_from": "2026-08-09T07:18:10Z"
        },
        "domain_age_days": 51,
        "apex_age_days": 51,
        "tls_age_days": 51,
        "tls_valid_days": 90,
        "requests": 17,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=63072000; includeSubDomains; preload",
            "content-security-policy": "img-src 'self' data: blob:; frame-ancestors 'self'; default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://fonts.gstati",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin-when-cross-origin",
            "permissions-policy": "camera=(), microphone=(), geolocation=()",
            "cross-origin-opener-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-27T01:50:03Z",
        "uuid": "3aa595f3-b052-4c4f-976c-7ebc974bf0ff",
        "scanned_at": "2026-10-27T01:19:01Z",
        "final_url": "https://freecapitalai.shop/",
        "status": 200,
        "history": [
            {
                "url": "https://freecapitalai.shop/",
                "status": 200
            }
        ],
        "dom_hash": "fb13440665a8a31fd1ce5e5a72753c1522147d760c4747b7a855abdf7850a826",
        "doc_hash": "94663240f1fc62416c775cb65af8515f522b73e62f6aec7547eb25a34dab1578",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "freecapitalai.shop",
                "type": "A",
                "value": "172.67.148.179"
            },
            {
                "name": "freecapitalai.shop",
                "type": "A",
                "value": "104.21.29.88"
            },
            {
                "name": "freecapitalai.shop",
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:94b3"
            },
            {
                "name": "freecapitalai.shop",
                "type": "AAAA",
                "value": "2606:4700:3032::6815:1d58"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.148.179",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-27T01:18:43Z",
        "analysis_at": "2026-10-21T18:05:25Z",
        "stats": {
            "timeout": 0,
            "harmless": 45,
            "malicious": 14,
            "suspicious": 3,
            "undetected": 30
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Bfore.Ai PreCrime": "malicious",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "first_seen": "2026-08-09T08:08:28Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "chelsea.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "chelsea.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::6815:1d58"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.148.179"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "jonah.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:94b3"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.29.88"
            }
        ],
        "dns_at": "2026-10-21T18:11:29Z",
        "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "freecapitalai.shop"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "13a612aa8466df050ec84fc7db6af5be",
            "sha256": "859c4a9cdf36732d339dab1a63ee3c586881edf22fe825ec2299278b94ef04be",
            "subject": "freecapitalai.shop",
            "valid_to": "2027-01-05T12:56:34Z",
            "valid_from": "2026-10-07T11:56:38Z"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-27T01:19:55Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "freecapitalai.shop"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-27T01:19:22Z",
            "first": "2026-10-27T01:19:22Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 42837
        },
        "robots_txt": {
            "agents": [
                "*",
                "Amazonbot",
                "Applebot-Extended",
                "Bytespider",
                "CCBot"
            ],
            "present": true,
            "sitemaps": [
                "https://freecapitalai.shop/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 140
        },
        "social_tags": {
            "ogUrl": "https://freecapitalai.shop/",
            "title": "Free Capital AI | a premium AI | Official Web Platform",
            "ogType": "website",
            "robots": "index, follow",
            "ogTitle": "Free Capital AI | Premier AI Trading Suite",
            "ogSiteName": "Free Capital AI",
            "themeColor": "#070B24",
            "description": "Free Capital AI delivers advanced AI-guided trading support, autonomous bots, robust portfolio tools, and streamlined market workflows for today's digital-asset participants.",
            "twitterCard": "summary",
            "canonicalUrl": "https://freecapitalai.shop/",
            "ogDescription": "Free Capital AI delivers advanced AI-guided trading support, autonomous bots, robust portfolio tools, and streamlined market workflows for today's digital-asset participants."
        },
        "trackers": {
            "requests": 16,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 7
                },
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 1
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://static.cloudflare.com/beacon.min.js",
                "https://challenges.cloudflare.com/turnstile/v0/api.js",
                "https://cdn.jsdelivr.net/npm/clientjs@0.2.1/dist/client.min.js"
            ],
            "third_party_scripts": 3
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 4,
                "tls": 28,
                "wait": 133,
                "connect": 23,
                "download": 38
            },
            "response_ms": 226
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 144305,
            "co2_grams": 0.0053,
            "cleaner_than": 14
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.194.177",
                    "host": "chelsea.ns.cloudflare.com"
                },
                {
                    "ip": "173.245.59.186",
                    "host": "jonah.ns.cloudflare.com"
                }
            ],
            "zone": "freecapitalai.shop"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "entry_url",
                    "secure": true,
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "2606:4700:3032::6815:1d58",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "freecapitalai.shop"
        },
        "dns": {
            "A": [
                "172.67.148.179",
                "104.21.29.88"
            ],
            "NS": [
                "jonah.ns.cloudflare.com",
                "chelsea.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"chelsea.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418086200, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2606:4700:3032::ac43:94b3",
                "2606:4700:3032::6815:1d58"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=31536000; includeSubDomains; preload",
            "message": "Site is compatible with the HSTS preload list!",
            "compatible": true
        },
        "http_security": {
            "xFrameOptions": "SAMEORIGIN",
            "referrerPolicy": "strict-origin",
            "xXSSProtection": false,
            "permissionsPolicy": "camera=(), microphone=(), geolocation=()",
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": "font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; default-src 'self'; connect-src 'self' https://c",
            "strictTransportPolicy": "max-age=31536000; includeSubDomains; preload",
            "crossOriginOpenerPolicy": "same-origin",
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3032::ac43:94b3",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://freecapitalai.shop"
            ]
        },
        "tech_stack": {
            "technologies": [
                "jsDelivr",
                "Cloudflare Turnstile",
                "Cloudflare Rocket Loader",
                "ClientJS",
                "Priority Hints",
                "Google Font API",
                "Font Awesome",
                "cdnjs",
                "HSTS",
                "Cloudflare",
                "Open Graph",
                "HTTP/3"
            ]
        },
        "linked_pages": {
            "internal_count": 38
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=utf-8",
                "strict-transport-security": "max-age=31536000; includeSubDomains; preload",
                "content-security-policy": "font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; default-src 'self'; connect-src 'self' https://cloudflareinsights.com https://challenges.cloudflare.com; frame-ancestors 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; img-src",
                "x-frame-options": "SAMEORIGIN",
                "x-content-type-options": "nosniff",
                "referrer-policy": "strict-origin",
                "permissions-policy": "camera=(), microphone=(), geolocation=()",
                "cross-origin-opener-policy": "same-origin"
            }
        }
    }
}
```