richnetsfunds[.]com

The domain richnetsfunds.com has been identified as a high-risk threat associated with generic phishing activity. As of July 27, 2026, the domain remains active and is currently resolving to the IP address 162.213.255.42. The domain was registered through Tucows Domains Inc. on November 05, 2024, and utilizes the nameservers dns1.namecheaphosting.com and dns2.namecheaphosting.com, which are common for bulk-registered domains and may indicate low-cost or ephemeral hosting infrastructure.

Security analysis reveals that three out of ninety-one security vendors on VirusTotal have flagged this domain as malicious or suspicious. Additionally, richnetsfunds.com is present on at least one security blocklist and is explicitly blocked by PhishDestroy, further substantiating its association with phishing campaigns. The domain's continued active status and presence on blocklists indicate ongoing risk to potential victims.

The specific content or brand targeted by richnetsfunds.com has not yet been analyzed, and there is no available information on the page title, scam kit, or targeted brands. As such, the precise nature of the phishing scheme—such as credential theft, financial fraud, or other malicious intent—remains undetermined based on current intelligence. There is also no data regarding SSL certificate status, HTTP response codes, or user traffic.

Defenders are advised to proactively block richnetsfunds.com across email gateways, web proxies, and endpoint security tools. Security teams should monitor for any network activity involving this domain or its associated IP address, and update incident response protocols to include this indicator. Continuous monitoring for updates to blocklists and detection feeds is recommended, as the domain's infrastructure remains live and may be used in ongoing or future phishing campaigns.