elitecapitalsgroup[.]com[.]cluncoinearn[.]net

PhishDestroy identifies elitecapitalsgroup.com.cluncoinearn.net as an active crypto drainer phishing domain posing elevated risk to cryptocurrency users and investors. This domain is engineered to deceive victims into connecting crypto wallets under the false pretense of high-yield investment opportunities or exclusive trading platforms, with the ultimate goal of draining digital assets via smart contract interactions or malicious wallet connection prompts. The threat actor leverages a multi-level subdomain structure (com.cluncoinearn.net) to mimic legitimate financial brands, specifically targeting users familiar with or seeking exposure to capital group services or crypto-earn platforms. Historical and behavioral analysis confirms ongoing campaign activity, with sustained infrastructure engagement and propagation via social media, messaging platforms, and fraudulent advertisements.

This domain was flagged by 10 out of 95 security vendors on VirusTotal, indicating partial detection coverage. It was registered on June 30, 2024, through OwnRegistrar, Inc., and resolves to IP address 37.27.68.99. The domain holds a valid SSL certificate issued by Let's Encrypt, which is commonly abused to establish trust with potential victims. The IP address has been associated with multiple low-reputation domains and exhibits characteristics consistent with bulletproof hosting environments. No known legitimate services are hosted at this address, and the domain has not yet been indexed on major blocklists such as Google Safe Browsing, PhishTank, or OpenPhish. Trust scores from threat intelligence platforms such as Cisco Talos and Spamhaus are classified as low or unrated, reinforcing its malicious classification.

Users are strongly advised to immediately block the domain elitecapitalsgroup.com.cluncoinearn.net at the network and DNS levels. Avoid accessing the site or clicking any links involving this domain, especially those promoting crypto investments, wallet connections, or financial giveaways. If the domain has been accessed, do not connect any cryptocurrency wallet or enter private keys or seed phrases. Disconnect from the internet, scan for malware using updated tools, and revoke any unintended wallet connections via blockchain explorers or wallet interfaces. Report the domain to your organization’s security team or to platforms like Google Safe Browsing, PhishTank, and local cybercrime units. Organizations should implement DNS filtering rules and endpoint protection to detect and block access to this domain and its associated IP address (37.27.68.99).