block-vestcapital[.]com

This domain, block-vestcapital.com, poses as a legitimate cryptocurrency investment platform to deceive users into believing it is affiliated with crypto.com. The site is designed to harvest login credentials, private keys, or trick victims into transferring cryptocurrency to attacker-controlled wallets. Brand impersonation of this nature typically leads to financial theft, where victims unknowingly authorize transactions or disclose sensitive account information to malicious actors. The site’s infrastructure and content are engineered to mimic the appearance and functionality of the authentic crypto.com platform, increasing the likelihood of successful deception. Analysis indicates this domain is part of a coordinated phishing campaign. It was registered on May 4, 2025, through Dynadot LLC, a registrar frequently used for newly created malicious domains. Security vendors on VirusTotal flagged the domain with 3 detections out of 95, a low but notable ratio that suggests early-stage detection before widespread blocking. The domain resolves to the IP address 198.251.89.34 and appears on one security blocklist, while threat intelligence platforms like AlienVault OTX have recorded it in a recent pulse. Technologies detected on the site include Bootstrap, jQuery, and LiteSpeed, which are common in both legitimate and fraudulent web applications, but their presence here aligns with typical phishing site tooling. Users who visited block-vestcapital.com should assume their interactions were compromised. Immediately revoke any connected wallet permissions or session tokens associated with crypto.com or other cryptocurrency services. Change passwords for all related accounts, enable multi-factor authentication where available, and monitor transaction histories for unauthorized activity. If cryptocurrency was transferred to any address provided by the site, report the incident to relevant exchanges and law enforcement agencies with transaction hashes and timestamps. Do not re-engage with the domain or any communications linked to it, as attackers may attempt follow-up social engineering attacks.