thrivecapital[.]ltd

The domain thrivecapital.ltd is a confirmed brand impersonation phishing site that targeted the brand Compound. It posed as a legitimate investment platform under the name 'Thrive Capital Investments' to deceive users into believing they were interacting with Compound-related services. The site is currently taken offline, but while active it presented an elevated risk due to its impersonation tactics and lack of security measures.

Technical indicators for thrivecapital.ltd include detection by 2 of 95 VirusTotal vendors, specifically ADMINUSLabs and Fortinet, and it appears on 2 security blocklists: PhishDestroy and Enkrypt. The domain was registered through NameSilo, LLC on July 12, 2023, and resolves to IP address 91.204.209.16 located in GB (AS52148 Enix Ltd). Google Safe Browsing did not flag the domain, but its Gridinsoft trust score is 1 out of 100. No SSL certificate was issued, and the page title observed was 'Home - Thrive Capital Investments'. The HTTP status returned 429, indicating the site may have been rate-limited or taken down.

Users who interacted with thrivecapital.ltd should take immediate safety steps. Since this was a brand impersonation without a drainer kit, the primary risk was credential theft or login phishing. Change any passwords entered on the site, enable two-factor authentication on related accounts, and monitor financial accounts for unauthorized activity. Report the domain to Google Safe Browsing and the impersonated brand Compound. No crypto drainer was present, so token approval revocation is not necessary, but remain vigilant for follow-up phishing attempts.