elitefundix[.]click

Analysis of elitefundix.click confirms its classification as an active phishing domain targeting digital banking users. The domain was registered on March 11, 2026, through Global Domain Group LLC and currently resolves to IP 192.142.10.129, hosted on AS214036 (Ultahost, Inc.) in the Netherlands. The page title, 'E-FUNDIX - Dedicated to innovating, simplifying, and humanizing digital banking,' explicitly indicates an attempt to impersonate a financial services platform, though no specific legitimate brand has been confirmed as the target. Infrastructure review reveals the use of nameservers ns1.cprapid.com and ns2.cprapid.com, alongside pro1.ecositewebhost.com and pro2.ecositewebhost.com, a configuration commonly observed in phishing operations leveraging bulletproof hosting providers. The domain is served over HTTP/3 with a valid Let's Encrypt SSL certificate (R13), which may lend a false sense of legitimacy to potential victims. Detected technologies include Bootstrap, LiteSpeed, GSAP, Smartsupp, OWL Carousel, and jQuery—tools frequently employed to create visually convincing fraudulent interfaces. The domain appears on one security blocklist (PhishDestroy) and is flagged by 2 of 95 security vendors on VirusTotal, though the absence of broader detection does not diminish its confirmed malicious status. MX records point to the domain itself (priority 0), suggesting potential use for credential harvesting via email redirection or phishing campaigns. Gridinsoft assigns a trust score of 0/100, reinforcing its high-risk designation. Defenders should treat elitefundix.click as an active threat. Network-level blocking is recommended, alongside monitoring for associated IP addresses, nameservers, and registration patterns linked to Global Domain Group LLC. The domain’s continued operation as of July 12, 2026, indicates ongoing risk, and further analysis of its content—if accessible—may reveal additional targeting details or campaign affiliations.