bravioncapital[.]com

The domain bravioncapital.com was identified as a credential harvesting phishing site targeting users of financial services. Analysis indicates the infrastructure was designed to impersonate a legitimate investment or capital management entity, as suggested by the page title 'Homepage - Bravion Сapital.' The domain is currently offline, but prior activity and detected indicators confirm its malicious intent. Infrastructure analysis reveals the domain resolved to the IP address 104.21.1.67 and was registered through Tucows Domains Inc. on February 23, 2026. It was flagged by 3 of 95 security vendors on VirusTotal and appears on three security blocklists, including MetaMask, PhishDestroy, and SEAL. The domain utilized a Let's Encrypt SSL certificate and employed technologies such as WordPress, MySQL, PHP, UIKit, Yoast SEO, Swiper, jQuery Migrate, and jQuery. The Gridinsoft trust score for this domain was 0 out of 100, further corroborating its malicious classification. The domain has since been taken offline, but the risk of residual exposure remains. Organizations and individuals are advised to block the domain and its associated IP address at the network level. Users who may have interacted with the site should reset credentials for any financial or sensitive accounts accessed during the exposure window. Security teams should monitor for related infrastructure, particularly domains registered through the same registrar or resolving to the same IP range, as threat actors often reuse components of their attack infrastructure.