ranga-capmark[.]com

This domain, ranga-capmark.com, is confirmed as a credential theft operation impersonating an artificial intelligence-based trading platform. Analysis of the site content and infrastructure reveals it mimics legitimate trading services, using Polish-language branding ('Platforma handlowa oparta na sztucznej inteligencji') to deceive users into submitting login credentials, personal information, and financial details. The site does not appear to deploy a known crypto drainer kit but focuses on harvesting sensitive data for subsequent fraudulent transactions or account takeovers. Infrastructure analysis reveals the domain was registered on February 9, 2026, through NETIM SAS, an unusual future date suggesting potential domain spoofing or incorrect WHOIS records. It resolves to IP address 172.245.112.196, hosted on AS36352 (HostPapa) in the United States. The domain is flagged by Google Safe Browsing as phishing and appears on three security blocklists. VirusTotal detection shows 19 out of 95 security vendors marking the domain as malicious. The site used a Let's Encrypt SSL certificate (serial number E7) to create a false sense of legitimacy. As of the latest verification, ranga-capmark.com has been taken offline, likely due to hosting provider intervention or registrar enforcement actions. However, the infrastructure remains a residual risk, as threat actors may redeploy the domain or migrate to new hosting providers. Users who interacted with the site should immediately reset credentials for any accounts accessed during the exposure period, enable multi-factor authentication, and monitor financial statements for unauthorized transactions. Organizations should update blocklists with the domain, IP, and associated SSL certificate to prevent future access attempts.