capital-turn[.]com

This domain, capital-turn.com, is identified as a credential theft phishing operation targeting users of financial platforms. Analysis of the page title, "Capital-Turn - Home," suggests an attempt to impersonate legitimate financial or investment services, likely to harvest login credentials, personal details, or payment information. No direct evidence of a crypto drainer kit was observed, but the use of technologies such as PHP, Firebase, and Smartsupp indicates a structured phishing infrastructure designed for data exfiltration and real-time interaction with victims. Infrastructure analysis reveals the following technical indicators: the domain is registered through COSMOTOWN, INC., and resolves to the IP address 163.61.188.9. It is flagged by 11 out of 95 security vendors on VirusTotal, with detections in two AlienVault OTX threat intelligence pulses. The domain appears on one security blocklist and is blocked by at least one endpoint protection mechanism. Additional indicators include the use of a Let's Encrypt SSL certificate, LiteSpeed web server, and frontend frameworks such as Bootstrap, jQuery, and Slick. The domain's current status is offline, though historical records confirm its prior operational state. Despite being taken offline, the residual risk associated with capital-turn.com remains elevated. The domain's registration details, combined with its appearance in multiple threat intelligence feeds, suggest it was part of a broader phishing campaign. Users who interacted with the site prior to its takedown may still be at risk of credential compromise or follow-up attacks. It is recommended to monitor accounts associated with any input data, reset passwords using multi-factor authentication, and review connected devices for unauthorized access. Organizations should update blocklists to include this domain and its resolving IP to prevent future exposure.