chainpluscapitals[.]ltd

ChainPlusCapitals.ltd is assessed as a high-risk domain with a specific threat type of brand impersonation. The domain appears to target and impersonate YouTube, a well-known brand, to deceive users and potentially engage in fraudulent activities.

Analysis indicates that ChainPlusCapitals.ltd has been flagged by 14 out of 95 security vendors on VirusTotal, suggesting a significant level of suspicion. The domain was registered through Dynadot LLC on February 23, 2026, and resolves to the IP address 173.0.59.2. It appears on three security blocklists and has been blocked by MetaMask, PhishDestroy, and SEAL, indicating a recognized threat in the security community. The domain has a ScamAdviser trust score of 1/100 and a Gridinsoft trust score of 0/100, both of which are extremely low and suggest high risk. The page title, 'ChainPlusCapital – Safe investment with Chainpluscapital,' further reinforces the deceptive nature of the site, attempting to mislead users into believing it is a legitimate investment platform associated with YouTube.

To mitigate the risk posed by this brand impersonation scam, users should avoid clicking on any links or entering personal information on the site. Security teams should implement DNS-based blocking to prevent access to the domain and monitor network traffic for any attempts to resolve the IP address 173.0.59.2. Additionally, it is recommended to educate employees and users about the dangers of brand impersonation and to verify the authenticity of any investment platforms or similar services they encounter online. Regular updates to browser and security software can also help in detecting and blocking such malicious sites.