trustfund-capital[.]net

This domain is flagged as an active generic phishing infrastructure. trustfund-capital.net was registered on 2025-06-03 through the Atak Domain registrar and resolves to the IPv4 address 86.107.77.152. The authoritative name servers are ns3.hostmane.net and ns4.hostmane.net, indicating hosting on the Hostmane platform. VirusTotal analysis shows that 2 of 91 security vendors have marked the domain as malicious, confirming that at least some scanners recognize it as abusive.

The domain appears on one public security blocklist and has been explicitly blocked by the PhishDestroy mitigation service, reinforcing the view that it is being used for malicious email or credential‑harvesting campaigns. The current operational status remains active as of the report date, July 27 2026. Evidence gaps include the lack of publicly available page content, SSL certificate details, HTTP response codes, and any associated campaign indicators such as targeted brands or phishing kits. Consequently, the full scope of the phishing campaign—whether it targets financial services, login portals, or other services—cannot be determined from the available data.

Defenders should add 86.107.77.152 to network deny lists and block DNS resolution for trustfund-capital.net at the perimeter. Email gateways should be updated to reject messages containing URLs that resolve to this domain. Endpoint protection solutions should incorporate the domain and its IP into their indicator sets, and security teams should monitor for any new detections from additional vendors. Continuous re‑scanning on VirusTotal and periodic checks against blocklists are recommended to capture any changes in the threat posture.