reclaim-capital[.]com

This domain is flagged as an elevated-risk brand impersonation threat targeting Ankr users through a deceptive FTX fund recovery scheme. Analysis indicates the site mimics legitimate cryptocurrency recovery services, presenting itself as "FTX Fund Recovery — Helping Creditors Get Their Money Back" to exploit victims of the FTX collapse. The infrastructure and page content suggest an intent to harvest sensitive financial or personal information from individuals seeking asset recovery. Infrastructure analysis reveals the domain reclaim-capital.com was registered on October 10, 2025, through Hosting Ukraine LLC and resolves to the IP address 5.255.121.177. It is detected by 4 out of 95 security vendors on VirusTotal and appears on one security blocklist. The domain employs a Let's Encrypt SSL certificate and is hosted on a server running WordPress, MySQL, PHP, Firebase, Ubuntu, and Nginx, with additional frontend components such as Swiper and jQuery UI. A Gridinsoft trust score of 0/100 and blocking by PhishDestroy further confirm its malicious classification. The domain is currently offline, but prior activity aligns with known phishing patterns. To mitigate risks associated with this threat type, affected users should avoid interacting with any communications or websites claiming to offer FTX fund recovery services. Organizations should update web filters to block reclaim-capital.com and its resolving IP 5.255.121.177. Users who may have engaged with the site should monitor financial accounts for unauthorized activity, reset credentials for cryptocurrency wallets or exchanges, and report the incident to relevant cybersecurity authorities. Security teams are advised to correlate this domain with other known FTX-themed phishing campaigns for broader threat hunting.