fundslip[.]xyz

PhishDestroy identifies www.fundslip.xyz as an active SSL-enabled phishing campaign targeting financial credentials, with infrastructure geared toward mimicking legitimate financial portals. This domain is engineered for one purpose: to trick users into surrendering sensitive login details under the guise of a trusted financial service provider. The threat actor has deployed a Let's Encrypt SSL certificate to lend false legitimacy to the fraudulent site, increasing the likelihood of victim engagement.

This domain was flagged by PhishDestroy on March 21, 2026, the same day it was registered through Atak Domain. Network telemetry confirms resolution to IP address 216.150.1.65. At the time of analysis, VirusTotal recorded 0 detections out of 95 scanners, indicating this domain has not yet been widely identified by automated defenses. The recent registration and absence of blocklist entries suggest an emerging and rapidly evolving threat that has not yet triggered widespread mitigation responses.

Users who accessed www.fundslip.xyz should immediately cease any credential input and discontinue interaction with the site. Change passwords for any accounts that may have been exposed and monitor financial transactions for unauthorized activity. Organizations and individuals are advised to block traffic to 216.150.1.65 at the network perimeter and submit the domain to local blocklists or threat intelligence platforms. Report the domain to your security provider, domain registrar abuse channels, and national cybercrime centers to aid collective defense. Remain vigilant for follow-on phishing attempts leveraging exposed credentials or leaked personal information.