foundatlon-0g[.]xyz

foundatlon-0g.xyz was registered on October 18 2025 through NiceNIC International Group Co., Limited. The domain resolves to 172.67.144.142, an address owned by Cloudflare (AS13335) located in the United States. Its authoritative nameservers are chris.ns.cloudflare.com and samara.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and CDN services. No TLS certificate is presented for the host, and the site is currently offline, consistent with the “taken offline” status reported by the monitoring team. Google Safe Browsing classifies the URL as a social‑engineering threat, and Gridinsoft assigns a trust score of 0/100, while Scamadviser reports a score of 1/100.

VirusTotal scans returned 17 positive detections out of 95 submitted engines. The domain appears on a single security blocklist and is actively blocked by PhishDestroy. AlienVault OTX references the domain in one threat‑intel pulse. The incident is categorized as brand impersonation aimed at Discord users, specifically employing wallet/seed phishing techniques to harvest cryptocurrency recovery phrases.

The available evidence confirms the infrastructure, registrar, and threat‑vendor markings, but no information on the HTTP response content, page title, or SSL details beyond the absence of a certificate is available. Defenders should add the domain and its resolving IP to block lists, enforce DNS‑sinkhole rules for the associated Cloudflare nameservers, and monitor for any re‑registration attempts. Continuous observation of Cloudflare‑hosted assets linked to the same IP range is advised, as attackers may shift to new sub‑domains under the same infrastructure. Because the site is offline, immediate mitigation focuses on preventing future activation rather than removing active payloads.