nidocapitorio[.]live

PhishDestroy identifies nidocapitorio.live as an active credential-harvesting domain designed to mimic legitimate login interfaces, likely targeting cryptocurrency wallet or exchange users. This domain was flagged under generic phishing due to its suspicious infrastructure and lack of detections despite clear malicious intent. Security monitoring shows it resolves to 104.21.82.230, relies on a Let's Encrypt SSL certificate, and was created on May 11, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The threat posed by nidocapitorio.live centers on mimicking authentic login pages to trick users into entering credentials or wallet recovery phrases. Unlike broad phishing campaigns, this domain appears focused on cryptocurrency targets, where stolen credentials can directly lead to fund theft. VirusTotal currently shows 0 detections out of 95 scanners, suggesting it evades many automated defenses. The domain’s recent creation date and reliance on legitimate SSL certificates (Let’s Encrypt) further highlight how attackers blend malicious infrastructure with trusted services to lower user suspicion. If you visited nidocapitorio.live, assume your credentials or wallet details were compromised. Immediately revoke any session tokens or recovery phrases entered on this site, transfer funds from connected wallets to a new address, and enable two-factor authentication on all accounts. Report the domain to PhishDestroy for further analysis, and scan your devices for malware. Never reuse passwords entered on suspicious sites, and verify URLs through official channels before submitting sensitive data.