fulss[.]com

This domain, fulss.com, operates as a fraudulent login portal targeting Spanish-speaking users, as indicated by the page title 'Inicio.' Analysis indicates the site is designed to harvest user credentials by mimicking legitimate service authentication pages. The threat primarily involves phishing for sensitive information, including usernames, passwords, and potentially multifactor authentication codes, which could lead to unauthorized account access or identity theft. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification of fulss.com. The domain is flagged by 12 out of 95 security vendors on VirusTotal, a significant red flag for phishing activity. It was registered through Hello Internet Corp on March 26, 2026, and appears on one security blocklist. The domain resolves to the IP address 44.211.14.38, hosted on a cloud infrastructure provider in the US (AWS EC2, us-east-1 region). The SSL certificate is issued by Let's Encrypt (R13), a common tactic among threat actors to lend a false sense of legitimacy to phishing sites. Users who visited fulss.com or entered credentials on the site should take immediate action to mitigate risks. First, reset passwords for any accounts accessed or entered on the site, prioritizing financial, email, and social media platforms. Enable multifactor authentication where available to add an additional security layer. Monitor accounts for unauthorized transactions or suspicious activity, and report any anomalies to the respective service providers. Given the elevated risk level, affected users should also consider running a full security scan on their devices to detect potential malware or keyloggers that may have been deployed during the interaction.