securefunds[.]one

The domain securefunds.one is currently active and classified as a high-risk credential theft operation targeting cryptocurrency wallet credentials. Analysis indicates this is not a generic phishing attempt but a specialized campaign designed to harvest login details for crypto asset management platforms, likely impersonating the TrustFunds brand or service. The domain remains operational and continues to resolve, posing an immediate threat to users interacting with crypto-related financial services. Infrastructure analysis reveals the domain was registered on April 13, 2026, through NameSilo, LLC, and currently resolves to the IP address 188.114.97.3, hosted by a content delivery network provider in Canada. Security telemetry shows the domain is flagged by 18 of 95 vendors on a major malware analysis platform and appears on three distinct security blocklists. The SSL certificate is issued by Google Trust Services under the WE1 intermediate, a common characteristic observed in both legitimate and malicious domains leveraging CDN infrastructure. The page title, TrustFunds, directly references the targeted brand, reinforcing the credential theft objective. Current status indicates the domain remains active and unmitigated, with no evidence of takedown or disruption. Users and organizations are advised to implement immediate network-level blocking of the domain and associated IP address. Security teams should update endpoint detection rules to include this domain in credential theft and crypto-related threat categories. Given the high-risk classification and active status, all interactions with securefunds.one should be treated as malicious, and any credentials entered on the site considered compromised. Monitoring for related domains registered through the same registrar or resolving to the same IP infrastructure is recommended for proactive threat hunting.