flujocapital-es[.]com

PhishDestroy has flagged flujocapital-es.com as a live crypto drainer targeting unsuspecting cryptocurrency users. The domain masquerades as Flujocapital, a legitimate investment platform, to deceive victims into connecting their wallets and approving malicious token contracts that silently drain funds. Security telemetry suggests this is a newly deployed campaign leveraging a generic seed to evade early detection, with infrastructure likely rented or compromised to host the drainer kit. The threat actor employs evasion techniques such as dynamic content rotation and short-lived domains to extend operational longevity while minimizing forensic footprint.

This domain resolves to IP 104.21.60.123 and was registered on May 13, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. VirusTotal currently reports 1/95 detections, indicating that mainstream antivirus engines have not yet flagged its malicious payloads. It utilizes a valid Let's Encrypt SSL certificate to appear legitimate, and despite its newness, it has not yet propagated to Google Safe Browsing (GSB) or other major blocklists. The absence of detections suggests this campaign is in its early stages, with the threat actor relying on low initial visibility to maximize victim engagement.

As of this report, flujocapital-es.com remains an active threat with no confirmed takedown or mitigation in place. PhishDestroy continues to monitor its behavior and infrastructure changes, including potential shifts in hosting or certificate rotation. The remaining risk is assessed as high due to the domain's recent activation, lack of detection coverage, and likely integration into broader phishing networks. Users are advised to avoid interacting with this domain, verify all investment-related URLs via trusted sources, and report any suspicious activity to PhishDestroy for further analysis.