Phishing sites impersonating Foundation

PhishDestroy has recorded 98 phishing domains impersonating Foundation since 2025-03-18, 1 of them in the last 30 days. The most used registrars are NiceNIC and PublicDomainRegistry.com; the most common TLDs are .com and .xyz. Open Foundation only from its official app or a saved bookmark.

98
Domains, all time
1
Last 30 days
31
Online at last check
21
Confirmed takedowns

New domains in the last 90 days

2026-07-25: 02026-07-26: 02026-07-27: 02026-07-28: 02026-07-29: 02026-07-30: 02026-07-31: 02026-08-01: 02026-08-02: 12026-08-03: 02026-08-04: 02026-08-05: 02026-08-06: 02026-08-07: 12026-08-08: 02026-08-09: 02026-08-10: 12026-08-11: 02026-08-12: 02026-08-13: 02026-08-14: 02026-08-15: 02026-08-16: 02026-08-17: 02026-08-18: 02026-08-19: 02026-08-20: 02026-08-21: 02026-08-22: 02026-08-23: 02026-08-24: 02026-08-25: 02026-08-26: 02026-08-27: 02026-08-28: 02026-08-29: 02026-08-30: 02026-08-31: 02026-09-01: 02026-09-02: 02026-09-03: 02026-09-04: 02026-09-05: 02026-09-06: 02026-09-07: 02026-09-08: 12026-09-09: 02026-09-10: 02026-09-11: 02026-09-12: 02026-09-13: 02026-09-14: 02026-09-15: 02026-09-16: 02026-09-17: 02026-09-18: 02026-09-19: 02026-09-20: 02026-09-21: 02026-09-22: 02026-09-23: 02026-09-24: 02026-09-25: 02026-09-26: 02026-09-27: 02026-09-28: 02026-09-29: 02026-09-30: 02026-10-01: 02026-10-02: 02026-10-03: 02026-10-04: 02026-10-05: 02026-10-06: 02026-10-07: 02026-10-08: 02026-10-09: 02026-10-10: 02026-10-11: 02026-10-12: 02026-10-13: 02026-10-14: 02026-10-15: 02026-10-16: 12026-10-17: 02026-10-18: 02026-10-19: 02026-10-20: 02026-10-21: 02026-10-22: 0
Foundation phishing domains detected per day: 5 from 2026-07-25 to 2026-10-22; peak 1.

How to tell a fake Foundation site

Words most often added to the brand in reported domains: hyperliquid, claim, avantisfi, portal, claims, succinct, airdrop, prod, cdn, jito.

  • Type the address yourself or use a bookmark; phishing links for Foundation arrive through ads, search results, direct messages and fake support accounts.
  • Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
  • Foundation will never ask for your seed phrase. Read every wallet signature: approvals, Permit and setApprovalForAll requests can hand over your assets.

Paste a suspicious address into the Homoglyph Checker or check it against the DestroyList.

Latest Foundation phishing domains

The 50 most recently detected domains impersonating Foundation
DomainFirst detectedStatus at last checkRegistrar
bfycozy.shop2026-10-16OnlineDynadot
admin.foundation.byrds.dev2026-09-08OnlineOVH
adi-foundation.info2026-08-10OnlineNICENIC
mt0508.6868dc.com2026-08-07OnlineGoDaddy.com
pay.ffoundation.io2026-08-02OnlineGoDaddy.com
claim.gradient-foundation.xyz2026-06-15OnlineNameSilo
bonus-based.com2026-05-11OnlinePublicDomainRegistry.com
182233.com2026-05-09OnlineGoDaddy.com
learns-en-ledgr.pages.dev2026-04-29OnlineCloudflare
foundation.avantisfi.fun2026-03-15OfflinePublicDomainRegistry.com
cryptio.top2026-02-26Offline耐思尼克国际集团有限公司
zerofoudationclaim.pages.dev2026-02-26OfflineCloudflare
distributions-hyperliquid.xyz2026-02-26OfflinePublicDomainRegistry.com
foundation-pendle.com2026-02-26OfflineWeb Commerce Communications dba WebNic.c
claim.succnicnt.foundation2026-02-26Offline—
mefoundnation.co2026-02-26Offline—
meboxchest.com2026-02-26Offline—
chestme.com2026-02-26OnlineDropCatch.com 544
adi-foundation.com2026-02-26Taken downCloudflare
pepessolana.pages.dev2026-02-26OfflineCloudflare
claim.succinctz.foundation2026-02-26Offline—
foundation.openedens.network2026-02-26Taken downPublicDomainRegistry.com
succinct-foundation.network2026-02-26OfflineNameSilo
mint.hypurrnfts.org2026-02-26OfflineWeb Commerce Communications dba WebNic.c
distribution-hype.net2026-02-26OfflinePublicDomainRegistry.com
nodefoundation.site2026-02-26Offline—
eligible.fabricfoundation.live2026-02-24Offline—
mgxalliance.com2026-02-22OnlineInternet Domain Service BS
common-common.com2026-02-16OfflineNiceNIC
xaman-foundation.app2026-02-12OnlineNiceNIC
superformfonudaiton.org2026-02-10UnknownNiceNIC
phantom-foundation-bqk.pages.dev2026-02-09OfflineCloudflare
plume-foundation-landing.pages.dev2026-02-07Taken downCloudflare
gitcon.co2026-02-07OfflinePublicDomainRegistry.com
hyperliquidsdsfnd.com2026-02-03OfflineWeb Commerce Communications
solgasfoundation.org2026-01-30Taken downMetaregistrar
crydex.solplanet.cc2026-01-22UnknownNiceNIC
yzy-hyperliquid.xyz2026-01-22OfflineRegistrar.eu
collect-foundation.com2026-01-06Taken downNiceNIC
hyperliquidlist.xyz2026-01-04Taken downName.com
claim.espresso-foundation.com2025-12-31UnknownNiceNIC
solvfinances.com2025-12-31UnknownNiceNIC
claim-sol-carnival.netlify.app2025-12-29Taken downNetlify
claim-espressofoundation.org2025-12-28Taken downCloudflare
espresso-foundation.com2025-12-23OfflineNiceNIC
espresso-foundation.xyz2025-12-23OfflinePublicDomainRegistry.com
fir10.209494.com2025-12-23Taken downGname.com
adida.foundation2025-12-20Taken downGoDaddy.com
jito.restaking.network2025-12-20OfflineENOM
jito.promo2025-12-17OfflineUnstoppable Domains

All 98 Foundation reports

Where they are registered and hosted

Registrars

  1. NiceNIC21
  2. PublicDomainRegistry.com15
  3. Cloudflare12
  4. Web Commerce Communications9
  5. GoDaddy.com4
  6. NameSilo3
  7. N/A2
  8. Registrar.eu2

Top-level domains

  1. .com24
  2. .xyz11
  3. .org9
  4. .foundation8
  5. .dev6
  6. .network5
  7. .cloud5
  8. .top3

Hosting networks

  1. CLOUDFLARENET, US61
  2. CLOUDFLARENET - Cloudflare, Inc., US9
  3. Cloudflare, Inc.9
  4. AMAZON-02, US3
  5. Partner-Hosting-LTD Partner Hosting LTD, GB2
  6. AS-COLOCROSSING, US2
  7. DREAMHOST-AS, US2
  8. SS-ASH, US1

Related

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Foundation; share of all PhishDestroy reports: 0.04%.