folkslabs[.]top

Analysis as of July 23, 2026 indicates that the domain folkslabs.top is being used for a high‑risk brand‑impersonation operation targeting the foundation brand. The domain was registered on March 18, 2025 through NiceNIC International Group Co., Limited and is hosted on the Cloudflare network (AS13335) with the IP address 188.114.97.3 located in the United States. DNS resolution points to Cloudflare nameservers rudy.ns.cloudflare.com and wren.ns.cloudflare.com, and no SSL certificate is present, meaning the site does not offer HTTPS protection. The page title returned by the server, "Folks Finance," does not match the targeted brand and suggests a possible attempt to lend credibility through a financial‑sounding name.

Reputation data shows the domain appears on one security blocklist and has a Gridinsoft trust score of 0 out of 100, indicating a severely untrusted reputation. Google Safe Browsing flags the site for social engineering, and PhishDestroy has already blocked the domain. VirusTotal analysis shows 14 of 95 security vendors label the domain as malicious, reinforcing the suspicion of malicious intent.

The current operational status is offline, limiting the ability to retrieve live content or HTTP response codes. Consequently, the exact nature of the fraudulent page (e.g., login capture, credential harvesting) remains unverified. However, the combination of brand‑impersonation labeling, multiple vendor detections, and blocklist presence provides strong evidence of an active phishing infrastructure.

Defenders should continue to monitor the IP address and DNS records for any re‑activation, enforce outbound filtering against the domain and its associated IP, and update internal blocklists. Incident response teams encountering traffic to this domain should treat any associated activity as malicious and isolate affected endpoints. Ongoing threat‑intel feeds should be consulted for any emerging indicators related to folkslabs.