fundsprotect[.]com

FundsProtect.com is currently flagged as a high‑risk generic phishing site associated with a crypto‑drainer campaign. Infrastructure analysis shows the domain resolves to IP address 13.223.25.84, an AWS EC2 instance in the us‑east‑1 region of the United States. The host presents a Let’s Encrypt certificate (issuer E7) and returns an HTTP 302 response, suggesting a redirect to another location. Nameservers are listed as domain-for-sale.hugedomainsdns.com and forsale.hugedomainsdns.com, which aligns with the page title "FundsProtect.com is for sale | HugeDomains" displayed in the HTTP response. The site was registered through TurnCommerce, Inc. DBA NameBright.com. Technical fingerprints identify CFML, Microsoft ASP.NET, Adobe ColdFusion, Typekit, reCAPTCHA, jQuery, Google Analytics and embedded YouTube content, indicating a complex stack possibly used to host malicious scripts. The domain appears on the PhishDestroy blocklist and is recorded on one additional security blocklist. VirusTotal scans report three detections out of ninety‑one scanners, and Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. No further content analysis is available, so the precise phishing landing page or credential‑harvesting mechanisms remain unverified. Defenders should treat the domain as hostile: block outbound connections to the associated IP, add the domain to internal URL filtering policies, and monitor for any traffic attempting to resolve or contact the host. Continuous re‑evaluation is advised should new content be observed, but current evidence supports immediate containment actions.