# PhishDestroy domain threat record: kapithaven.digital Content language: English Canonical HTML report: https://phishdestroy.io/domain/kapithaven.digital/ Machine-readable companion: https://phishdestroy.io/domain/kapithaven.digital/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-14 18:36:02 UTC - Last availability or vendor check: 2026-10-21 22:32:34 UTC - Stored record updated: 2026-10-22 06:21:58 UTC - VirusTotal detections in the stored snapshot: 15/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 188.114.96.3 - Registrar in stored WHOIS data: NETIM SAS - Registrar country in stored WHOIS data: Unknown - Last stored HTTP status: 200 - Registration date (registry RDAP, kapithaven.digital): 2026-07-22 14:46:36 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a0a135-4f14-73da-8d8f-43488021a21b/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/kapithaven.digital - Certificate Transparency search: https://crt.sh/?q=%25.kapithaven.digital - Web Archive lookup: https://web.archive.org/web/*/https://kapithaven.digital/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview kapithaven.digital operates as a fraudulent cryptocurrency trading platform under the KapitHaven brand, targeting retail investors seeking automated or AI-assisted trading returns. PhishDestroy first identified it on 2026-09-14, and it remains fully live with active content as of 2026-10-19. The site carries no legitimate regulatory standing and exists to defraud users who deposit funds expecting genuine trading activity. How the scam works Fake exchange platforms like KapitHaven draw victims in with polished dashboards, promises of AI-driven profits, and fabricated account balances that appear to grow over time. The page title — 'KapitHaven | AI Trading Platform | Authorized Web Resource' — is consistent with this approach, projecting legitimacy to lower a visitor's guard. When a user attempts to withdraw, the platform typically blocks the request or demands additional fees, taxes, or identity verification payments that never result in a real payout. Every deposit goes directly to the fraudsters. Evidence Fifteen of 89 engines on VirusTotal flagged this domain as malicious as of 2026-09-24, with detections from BitDefender, ESET, Fortinet, Forcepoint ThreatSeeker, CRDF, CyRadar, alphaMountain.ai, and Chong Lua Dao, among others. The domain appears on the PhishDestroy blocklist and has generated five independent threat intelligence pulses on OTX, confirming it has been corroborated across multiple research communities. Infrastructure The domain was registered on 2026-07-22 through NETIM SAS, less than two months before PhishDestroy first flagged it. It runs behind Cloudflare infrastructure on an IP geolocated to Canada, with a TLS certificate issued by Google Trust Services under the WE1 intermediate. This combination of CDN-based hosting and an automated certificate keeps the operator's true location obscured. What to do If you deposited funds on this platform, treat them as unrecoverable and do not send further money in response to any withdrawal fee or verification demand. Report the fraud to your national financial regulator and contact your bank or card provider immediately to explore a chargeback or payment recall. Security teams should block kapithaven.digital at the DNS and firewall level and notify any users who accessed it on managed networks. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a0a135-4f14-73da-8d8f-43488021a21b/ VirusTotal report: https://www.virustotal.com/gui/domain/kapithaven.digital Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=kapithaven.digital Archived copy: https://web.archive.org/web/20260922035310/https://kapithaven.digital/ Revoke token approvals: https://revoke.cash/ Report crypto fraud (Chainabuse): https://www.chainabuse.com/report Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 08:32:08 UTC ## Stored page captures - Primary capture: https://i.ibb.co/5hGqYcgt/0e9cfc58aff2.png Captured: 2026-09-14 18:38:20 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a0a135-4f14-73da-8d8f-43488021a21b.png Captured: 2026-09-14 18:38:20 UTC Source report: https://urlscan.io/result/01a0a135-4f14-73da-8d8f-43488021a21b/ - URLScan capture 2: https://urlscan.io/screenshots/019fbc47-9c16-7268-8ad6-84203b5a01ab.png Captured: 2026-09-14 18:36:02 UTC Source report: https://urlscan.io/result/01a0a135-4f14-73da-8d8f-43488021a21b/ - URLQuery: https://screenshots.phishdestroy.io/uq/5640c3fa-ef85-41f6-9f0d-6db9d07d0aac.png Captured: 2026-09-14 18:41:40 UTC Source report: https://urlquery.net/report/5640c3fa-ef85-41f6-9f0d-6db9d07d0aac SHA-256: 8f862f6b23ff24a4ae2742defc6627873412e546481b6c0b2c1f79b7551d87e7 - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/aabb325f-8187-4ded-8482-23aab5b3ecd8.png Captured: 2026-09-14 18:39:30 UTC Source report: https://radar.cloudflare.com/scan/aabb325f-8187-4ded-8482-23aab5b3ecd8 SHA-256: fc0b67376ffe3ecad0212b4c8ca6ed6687e43428c2d90a1fa0a606f57a2a28c2 - URLScan · 2026-07-31: https://screenshots.phishdestroy.io/us/019fb895-879e-72ff-9c60-db5492561772.png Captured: 2026-07-31 14:30:47 UTC Source report: https://urlscan.io/result/019fb895-879e-72ff-9c60-db5492561772/ SHA-256: 6381910d96a6ba90f6d572645bb6304bc6f26a9abbfe3bed5f87cd329fee3485 - URLScan · 2026-08-01: https://screenshots.phishdestroy.io/us/019fbc47-9c16-7268-8ad6-84203b5a01ab.png Captured: 2026-08-01 07:44:02 UTC Source report: https://urlscan.io/result/019fbc47-9c16-7268-8ad6-84203b5a01ab/ SHA-256: 08be038ec2ad75ab3bb58ccbaa4b226f9b4aa61e34d53bedeb5524cf9770ae5e - URLScan · 2026-09-14: https://screenshots.phishdestroy.io/us/01a0a136-c65b-74c4-af76-873daf069ec9.png Captured: 2026-09-14 18:38:50 UTC Source report: https://urlscan.io/result/01a0a136-c65b-74c4-af76-873daf069ec9/ SHA-256: 9fdf64ef1a358da48ec2258d2c0195803a66d0bcf2ac01ad5e158d64e67ce134 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T00:14:46Z", "uuid": "01a0a135-4f14-73da-8d8f-43488021a21b", "scanned_at": "2026-09-14T18:37:07Z", "final_url": "https://kapithaven.digital/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://kapithaven.digital/", "from": "http://kapithaven.digital/", "status": 307 } ], "ip": "2a06:98c1:3121::3", "domains": [ "cdnjs.cloudflare.com", "fonts.gstatic.com", "cdn.jsdelivr.net", "fonts.googleapis.com", "static.cloudflare.com" ], "ips": [ "142.251.20.94", "2606:4700::6811:cf05", "188.114.96.3", "2a00:1450:4001:c0f::5f", "104.17.25.14", "2a06:98c1:3121::3" ], "asns": [ "15169", "13335" ], "countries": [ "US", "DE" ], "doc_hash": "674424f521176f61ff4984392abd6ecfc178a623f2b86b433c6ffd6d77d9e239", "script_hashes": [ "ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142" ], "globals": [ "LANG_MSGS", "ClientJS", "_q9cd5v", "toggleTermsPopup", "__cfQR", "__cfRLUnblockHandlers", "__lgT0" ], "cookies": [ "entry_url" ], "tls": { "san": [ "kapithaven.digital" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "kapithaven.digital", "protocol": "TLS 1.3", "valid_to": "2026-10-29T01:05:18Z", "valid_from": "2026-07-31T00:05:22Z" }, "domain_age_days": 54, "apex_age_days": 54, "tls_age_days": 45, "tls_valid_days": 90, "requests": 20, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=31536000; includeSubDomains; preload", "content-security-policy": "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.cloudflare.com https://cdn.jsdelivr.net; connect-src 'self' https://cloudflareinsights.com; style-src 'self' 'unsafe-inline' https://font", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "no-referrer-when-downgrade", "permissions-policy": "camera=(), microphone=(), geolocation=()", "cross-origin-opener-policy": "same-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T00:25:45Z", "uuid": "aabb325f-8187-4ded-8482-23aab5b3ecd8", "scanned_at": "2026-09-14T18:39:30Z", "final_url": "https://kapithaven.digital/", "status": 200, "history": [ { "url": "https://kapithaven.digital/", "status": 200 } ], "dom_hash": "e68cca8f8f7bf2db3ead28aeb438076c5bc0c03936bba305f948380d13f82b9a", "doc_hash": "01ced3281bf2a39ccb6dfccf0f34eff791b7f4960a1f99f59e81ab14600560f8", "phishing_v2": [ "phishing" ], "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "kapithaven.digital", "type": "A", "value": "188.114.96.0" }, { "name": "kapithaven.digital", "type": "A", "value": "188.114.97.0" }, { "name": "kapithaven.digital", "type": "AAAA", "value": "2a06:98c1:3121::" }, { "name": "kapithaven.digital", "type": "AAAA", "value": "2a06:98c1:3120::" } ], "dnssec_valid": false, "ip": "188.114.96.0", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] }, "whois": { "registrar": "NETIM SAS", "created": "2026-07-22T14:46:36Z", "updated": "2026-08-12T02:08:52Z", "expires": "2027-07-22T14:46:36Z", "nameservers": [ "monika.ns.cloudflare.com", "razvan.ns.cloudflare.com" ] } } } ```