thecrypto[.]capital

The domain www.thecrypto.capital is a confirmed phishing site engaged in brand impersonation targeting users of the cryptocurrency platform 'base'. It operates as a cryptocurrency scam, designed to deceive victims into believing they are interacting with a legitimate service. No drainer kit was detected, but the site was actively used for fraudulent purposes before being taken offline.

Technical analysis of www.thecrypto.capital reveals limited but notable detection. As of the latest scan, 1 of 95 VirusTotal security vendors flagged the domain, while Google Safe Browsing did not issue a warning. The domain appears on 1 security blocklist, specifically PhishDestroy. Registered through GoDaddy.com, LLC on November 09, 2024, it resolves to the IP address 13.60.143.163, hosted on Amazon.com, Inc. infrastructure (AS16509) in Sweden. The SSL certificate was issued by Let's Encrypt (E7), and the observed page title was 'The Crypto Capital'. Detected technologies include Ubuntu, Bootstrap, Nginx, jQuery, Mautic, and DataTables. Gridinsoft assigned a trust score of 0 out of 100, further indicating its malicious nature.

Users who interacted with www.thecrypto.capital should immediately revoke any token approvals granted to unknown contracts and transfer remaining funds to a new, secure wallet. If credentials were entered, change passwords on the legitimate 'base' platform and enable two-factor authentication. Monitor accounts for unauthorized transactions and report the incident to the impersonated brand's support team. Additionally, victims can submit the domain to platforms like Google Safe Browsing, PhishTank, or local cybersecurity authorities to prevent further abuse.