# PhishDestroy domain threat record: prosperacapitallimited.ltd

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/prosperacapitallimited.ltd/
Machine-readable companion: https://phishdestroy.io/domain/prosperacapitallimited.ltd/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-27 19:20:23 UTC
- Last availability or vendor check: 2026-10-27 23:00:26 UTC
- Stored record updated: 2026-10-28 00:46:55 UTC
- VirusTotal detections in the stored snapshot: 12/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 198.251.89.220
- Registrar in stored WHOIS data: PDR Ltd. d/b/a PublicDomainRegistry.com
- Last stored HTTP status: 307
- Registration date in stored WHOIS data: 2025-11-18 18:36:35 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a17e6a-0fbb-72c9-874b-fa0f1df84a66/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/prosperacapitallimited.ltd
- Certificate Transparency search: https://crt.sh/?q=%25.prosperacapitallimited.ltd
- Web Archive lookup: https://web.archive.org/web/*/https://prosperacapitallimited.ltd/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed prosperacapitallimited.ltd on its internal blocklist as a suspicious domain. The recorded page title was “Prosperacapital Limited” and the HTTP response on 2026-10-27 was a 307 redirect to a third‑party verification service. PhishDestroy first observed the domain on 2026-10-27.

How the scam works
A domain that redirects visitors to a third‑party verification service can be used to harvest login credentials, lure users into further malicious pages, or generate fraudulent traffic. The current classification reflects the risk of such behavior without confirming a specific phishing or fraud scheme.

Evidence
VirusTotal scanned the domain on 2026-10-24 and flagged it as malicious by 12 of 92 engines, including BitDefender, Fortinet and Kaspersky. Google Safe Browsing checked on 2026-10-27 reported no warning. Cloudflare Radar on the same day labeled the URL as phishing and a scam. URLScan captured the site on 2026-10-27, returned an overall clean verdict but its engine analysis marked it malicious. OTX listed two pulses referencing the domain; no external blocklists reported it.

Infrastructure
The domain was registered on 2025-11-18 through PDR Ltd. d/b/a PublicDomainRegistry.com, with a client‑transfer‑prohibited status. The recorded IP was 198.251.89.220, which was associated with FranTech Solutions in Luxembourg, and the observed TLS certificate was issued by Let’s Encrypt and was valid until 2026-12-20. DNS records included NS entries at ns27.my-control-panel.com and ns28.my-control-panel.com, an MX record pointing to the domain itself, and an SPF TXT record allowing the host IP 192.168.168.2.

What to do
Do not enter credentials or personal information on the site; if any were submitted, change the associated passwords immediately. Security teams should block the domain and monitor network logs for connections to the recorded IP address. Continue to watch reputable threat feeds for any updates on this domain’s activity.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17e6a-0fbb-72c9-874b-fa0f1df84a66/
Cloudflare Radar report: https://radar.cloudflare.com/scan/43926139-7ae2-419f-afdb-2c2df8296422
Stored capture screenshot: https://urlscan.io/screenshots/01a17e6a-0fbb-72c9-874b-fa0f1df84a66.png
Cloudflare Radar screenshot (2026-10-27T19:20:48Z): https://screenshots.phishdestroy.io/cf/43926139-7ae2-419f-afdb-2c2df8296422.png
URLScan screenshot (2026-07-27T04:45:42Z): https://screenshots.phishdestroy.io/us/019fa1e4-46ee-74fb-9e97-50d1a3558cb1.png
URLScan capture report: https://urlscan.io/result/019fa1e4-46ee-74fb-9e97-50d1a3558cb1/
VirusTotal report: https://www.virustotal.com/gui/domain/prosperacapitallimited.ltd
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=prosperacapitallimited.ltd
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-27 20:08:54 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a17e6a-0fbb-72c9-874b-fa0f1df84a66.png
  Captured: 2026-10-27 19:20:23 UTC
- URLScan · 2026-07-27: https://screenshots.phishdestroy.io/us/019fa1e4-46ee-74fb-9e97-50d1a3558cb1.png
  Captured: 2026-07-27 04:45:42 UTC
  Source report: https://urlscan.io/result/019fa1e4-46ee-74fb-9e97-50d1a3558cb1/
  SHA-256: 2e85b31c78d91635bc0dae6569fe1fc540db9aa49111b6f716d610fb1451917b
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/43926139-7ae2-419f-afdb-2c2df8296422.png
  Captured: 2026-10-27 19:20:48 UTC
  Source report: https://radar.cloudflare.com/scan/43926139-7ae2-419f-afdb-2c2df8296422
  SHA-256: 2f79e5157aee8d11f0bc4040917bf966c4520aca9465540929c6a4c2ddd4ab71

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-27T19:21:05Z",
        "uuid": "01a17e6a-0fbb-72c9-874b-fa0f1df84a66",
        "scanned_at": "2026-10-27T17:31:12Z",
        "final_url": "https://prosperacapitallimited.ltd/",
        "domain_age_days": 342,
        "apex_age_days": 342,
        "requests": 1,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 92,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-27T19:25:44Z",
        "uuid": "43926139-7ae2-419f-afdb-2c2df8296422",
        "scanned_at": "2026-10-27T19:20:48Z",
        "final_url": "https://prosperacapitallimited.ltd/",
        "status": 200,
        "history": [
            {
                "url": "https://prosperacapitallimited.ltd/",
                "status": 200
            }
        ],
        "dom_hash": "ce1f89542ffeeae7979e9b70787388ca331eb18c6402c9b89faa738cb6ae467b",
        "doc_hash": "112adc7ea87e802174ed76a1a83d9df6c6ccb77128c3965aff4a9f6a5a8857c4",
        "phishing_v2": [
            "phishing"
        ],
        "url_risks": [
            "Scam"
        ],
        "domain_risks": [
            "Scam",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "prosperacapitallimited.ltd",
                "type": "A",
                "value": "198.251.89.220"
            }
        ],
        "dnssec_valid": false,
        "ip": "127.0.1.14"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-27T19:56:35Z",
        "analysis_at": "2026-10-24T14:46:50Z",
        "stats": {
            "timeout": 0,
            "harmless": 47,
            "malicious": 12,
            "suspicious": 0,
            "undetected": 33
        },
        "detections": {
            "CRDF": "malicious",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Fortinet": "phishing",
            "Netcraft": "malicious",
            "Kaspersky": "phishing",
            "Gridinsoft": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "created": "2025-11-18T00:00:00Z",
        "updated": "2025-11-18T00:00:00Z",
        "first_seen": "2025-11-18T22:33:16Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns28.my-control-panel.com"
            },
            {
                "ttl": 14400,
                "type": "A",
                "value": "198.251.89.220"
            },
            {
                "ttl": 21600,
                "type": "SOA",
                "rname": "root.c8.my-control-panel.com",
                "value": "ns27.my-control-panel.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns27.my-control-panel.com"
            },
            {
                "ttl": 14400,
                "type": "TXT",
                "value": "v=spf1 +a +mx +ip4:192.168.168.2 ~all"
            },
            {
                "ttl": 14400,
                "type": "MX",
                "value": "prosperacapitallimited.ltd",
                "priority": 0
            }
        ],
        "dns_at": "2026-10-24T14:49:43Z",
        "jarm": "29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3ae",
        "cert": {
            "san": [
                "autoconfig.prosperacapitallimited.ltd",
                "autodiscover.prosperacapitallimited.ltd",
                "cpanel.prosperacapitallimited.ltd",
                "cpcalendars.prosperacapitallimited.ltd",
                "cpcontacts.prosperacapitallimited.ltd",
                "mail.prosperacapitallimited.ltd",
                "prosperacapitallimited.ltd",
                "webdisk.prosperacapitallimited.ltd",
                "webmail.prosperacapitallimited.ltd",
                "www.prosperacapitallimited.ltd"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "59e4b2a14385fc0317aaa969ac4d6b1c73e",
            "sha256": "953090b75e1f62dd922f65d81daf53bb66a99a9d6a5378d845199834d746038a",
            "subject": "cpanel.prosperacapitallimited.ltd",
            "valid_to": "2026-12-20T21:15:30Z",
            "valid_from": "2026-09-21T21:15:31Z"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "last changed": "2026-01-18T01:05:32Z",
                "registration": "2025-11-18T19:36:35Z",
                "registrar expiration": "2026-11-18T19:36:35Z",
                "last update of RDAP database": "2026-10-17T16:41:47Z"
            },
            "registrar": "PDR Ltd. d/b/a PublicDomainRegistry.com",
            "registrar_iana_id": "303"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-27T19:21:36Z",
        "mail_config": {
            "mx": [
                "prosperacapitallimited.ltd"
            ],
            "spf": "v=spf1 +a +mx +ip4:192.168.168.2 ~all",
            "dkim": [
                "default"
            ],
            "dmarc": true,
            "dkim_bits": 2048,
            "spf_lookups": 2
        },
        "caa_records": {
            "domain": "prosperacapitallimited.ltd"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "social_tags": {
            "title": "Human verification",
            "robots": "noindex,nofollow"
        },
        "mixed_content": {
            "no_sri": [
                "https://challenges.cloudflare.com/turnstile/v0/api.js",
                "https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"
            ],
            "third_party_scripts": 2
        },
        "status": {
            "up": true,
            "code": 307,
            "timings": {
                "dns": 74,
                "tls": 70,
                "wait": 614,
                "connect": 62,
                "download": 0
            },
            "response_ms": 820
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                21,
                25,
                53,
                80,
                110,
                143,
                443,
                587,
                993,
                995,
                3306
            ]
        },
        "carbon": {
            "bytes": 82942,
            "co2_grams": 0.003,
            "cleaner_than": 26
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "198.251.89.220",
                    "host": "ns28.my-control-panel.com"
                },
                {
                    "ip": "107.189.13.189",
                    "host": "ns27.my-control-panel.com"
                }
            ],
            "zone": "prosperacapitallimited.ltd"
        },
        "location": {
            "ip": "198.251.89.220",
            "asn": "53667",
            "org": "FranTech Solutions",
            "city": "Luxembourg",
            "country": "LU"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR1",
            "subject": "cpanel.prosperacapitallimited.ltd"
        },
        "dns": {
            "A": [
                "198.251.89.220"
            ],
            "MX": [
                "{\"exchange\": \"prosperacapitallimited.ltd\", \"priority\": 0}"
            ],
            "NS": [
                "ns28.my-control-panel.com",
                "ns27.my-control-panel.com"
            ],
            "SOA": "{\"nsname\": \"ns27.my-control-panel.com\", \"hostmaster\": \"root.c8.my-control-panel.com\", \"serial\": 2026102703, \"refresh\": 3600, \"retry\": 1800, \"expire\": 1209600, \"minttl\": 86400}",
            "TXT": [
                "v=spf1 +a +mx +ip4:192.168.168.2 ~all"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": "max-age=15768000",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "198.251.89.220",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://prosperacapitallimited.ltd",
                "https://recaptcha.cloud/"
            ],
            "count": 1
        },
        "subdomains": {
            "count": 9,
            "subdomains": [
                "autoconfig.prosperacapitallimited.ltd",
                "autodiscover.prosperacapitallimited.ltd",
                "cpanel.prosperacapitallimited.ltd",
                "cpcalendars.prosperacapitallimited.ltd",
                "cpcontacts.prosperacapitallimited.ltd",
                "mail.prosperacapitallimited.ltd",
                "webdisk.prosperacapitallimited.ltd",
                "webmail.prosperacapitallimited.ltd",
                "www.prosperacapitallimited.ltd"
            ]
        },
        "linked_pages": {
            "external": [
                "http://www.opsshield.com/captcha/"
            ],
            "external_count": 1
        },
        "headers": {
            "headers": {
                "server": "nginx/1.18.0",
                "content-type": "text/html; charset=UTF-8",
                "strict-transport-security": "max-age=15768000"
            }
        }
    }
}
```