coinvestcapitals[.]com

Analysis indicates that coinvestcapitals.com was registered on July 07, 2025 through Cosmotown, Inc. The domain resolves to 172.245.14.131, an address owned by AS36352 HostPapa in the United States. The site served a TLS certificate from Let’s Encrypt (R13) and advertised HTTP/3 support. Technical fingerprints show the presence of Bootstrap, LiteSpeed, jQuery, jQuery UI, Popper, FancyBox and JivoChat, all common in low‑cost web kits. The page title returned “Home”, but the site is currently taken offline. Intelligence flags the domain as a crypto‑related scam that impersonates crypto.com.

Four of ninety‑five VirusTotal scanners flagged the host, and a Gridinsoft trust score of 0 / 100 together with a Scamadviser score of 1 / 100 reinforce its malicious posture. The domain appears on a single security blocklist and has been added to PhishDestroy’s block list. MX records point only to the domain itself, suggesting no legitimate mail handling. No further public reports or open‑source indicators have been published, leaving the exact phishing payload or lure undisclosed.

Defenders should block DNS resolution to 172.245.14.131 and add coinvestcapitals.com to web‑filter deny lists. Email gateways should reject or quarantine any messages originating from or referencing this domain. Continuous monitoring of the IP range owned by HostPapa is advised, as the provider has historically hosted related cryptocurrency fraud infrastructure. Incident response teams should also watch for variants that reuse the same JavaScript libraries and SSL configuration, as these artifacts may indicate re‑deployment of the same campaign.