user.only-capital.net: Crypto Scam Infrastructure Uncovered

PhishDestroy identifies user.only-capital.net as a suspected cryptocurrency scam domain deployed to harvest credentials and drain digital wallets. The domain mimics legitimate financial services to trick users into depositing crypto assets under false promises of high returns. IP 104.21.9.89 hosts this fraudulent infrastructure, which has yet to trigger detections across security engines despite its active status. user.only-capital.net exhibits classic red flags: created on August 14 2025—less than one month ago—and remains undetected on 0 out of 95 VirusTotal engines. It was registered via PDR Ltd. using a Google Trust Services SSL certificate to appear credible. The domain’s recent vintage and low blocklist presence suggest it is part of a fast-moving campaign that has evaded initial scrutiny. If you visited user.only-capital.net, disconnect affected devices from networks immediately and revoke any API keys or wallet permissions granted to the site. Rotate passwords used on this or similar domains and monitor accounts for unauthorized transactions. Report the domain to your email provider and firewall teams using IP 104.21.9.89 for network-level blocking to prevent further access.