flowingfunded[.]com

Analysis of flowingfunded.com indicates a high-risk phishing domain targeting financial or investment services. The domain was registered on November 5, 2025, through IONOS SE, a registrar frequently used for both legitimate and malicious infrastructure. As of July 27, 2026, the domain remains active and resolves to the IP address 185.158.133.1, which has been associated with other suspicious activity in recent threat intelligence reports. The nameserver configuration—ns1025.ui-dns.biz, ns1040.ui-dns.de, ns1070.ui-dns.org, and ns1080.ui-dns.com—is consistent with hosting providers that allow rapid domain deployment, a tactic often exploited by threat actors to evade detection.

Security vendor coverage is limited but notable: one of 91 vendors on VirusTotal has flagged the domain as malicious, and it appears on at least one security blocklist, including PhishDestroy. The absence of broader detection does not confirm safety; many newly registered phishing domains evade initial scans before gaining wider attention. The domain’s infrastructure shows no signs of takedown, and its continued resolution suggests ongoing operational intent. Defenders should treat flowingfunded.com as an active threat.

Network-level blocking is recommended for organizations, particularly those in financial services or sectors handling sensitive user data. Security teams should monitor for connections to 185.158.133.1 and the listed nameservers, as these may serve as indicators of compromise (IOCs) for related campaigns. While the exact content of the site has not been analyzed, the domain’s naming convention and registration patterns align with fraudulent investment or financial scam operations. Additional scrutiny, such as SSL certificate inspection or HTTP response analysis, may provide further evidence of malicious intent, though no such data is currently available in the provided intelligence.