thrivecapitallimited[.]com

This domain, thrivecapitallimited.com, is flagged as a confirmed investment scam site impersonating a legitimate capital investment brand. Analysis indicates the site employs brand impersonation tactics to deceive victims into disclosing financial credentials or transferring funds under false pretenses. The page title, 'Thrive capital limited – Safe investment with Thrive capital limited,' reinforces the fraudulent narrative by mimicking professional investment platforms. No direct evidence of a crypto drainer kit was observed, but the site's structure aligns with credential theft and financial fraud operations. Infrastructure analysis reveals the domain was registered on October 15, 2025, through Hosting Concepts B.V. d/b/a Registrar.eu. It resolves to the IP address 86.107.77.182 and is secured with a Let's Encrypt SSL certificate, a common tactic to lend superficial legitimacy. VirusTotal detection shows 13 out of 95 security vendors flagging the domain as malicious, while it appears on three independent security blocklists. The domain was also identified in one AlienVault OTX threat intelligence pulse, further corroborating its malicious nature. No Google Safe Browsing (GSB) status is available, but it is actively blocked by multiple security tools, including MetaMask and PhishDestroy. The domain is currently offline, likely due to takedown efforts or infrastructure changes by the threat actor. However, the remaining risk persists, as the registration remains active and the infrastructure could be reactivated. Organizations and individuals are advised to block the domain and associated IP at the network level, monitor for related phishing campaigns, and educate users on recognizing investment scam indicators. Financial institutions should flag any transactions linked to this domain or its impersonated brand for fraud review. Given the domain's recent creation and high-risk indicators, continued vigilance is warranted.