epica-fundrelix[.]com

The domain epica-fundrelix.com has been identified as a high-risk brand impersonation phishing site designed to mimic the legitimate Epica Fund investment platform. Analysis indicates this infrastructure was specifically crafted to deceive users into submitting financial or personal credentials under the guise of an official 2026 investment portal. The site is currently offline, though its prior operational status and infrastructure remain relevant for forensic and defensive purposes. Infrastructure analysis reveals the domain was registered on February 24, 2026, through NETIM SAS, a registrar frequently associated with transient malicious domains. It resolved to the IP address 94.26.38.51, hosted on AS202412 (Omegatech LTD) in Bulgaria, a network segment with a documented history of hosting fraudulent financial schemes. The site was flagged by 20 of 95 security vendors on VirusTotal, including detections from multiple anti-phishing engines. It appears on three independent security blocklists and was proactively blocked by browser-based threat prevention systems. The SSL certificate, issued by Let’s Encrypt (serial E8), was likely automated and provided no meaningful trust validation, consistent with phishing infrastructure patterns. Current status confirms the domain has been taken offline, though residual risk remains due to potential re-activation or migration to similar domains. Organizations and end-users are advised to treat any future communications referencing Epica Fund or the 2026 portal designation with extreme caution. Security teams should update blocklists to include the domain and associated IP, monitor for related domains registered through the same registrar, and conduct retrospective log analysis for connections to 94.26.38.51. Users who may have interacted with the site should immediately revoke any submitted credentials, enable multi-factor authentication on financial accounts, and report the incident to relevant fraud response authorities.