truefoundation-claim[.]xyz

The domain truefoundation-claim.xyz is a phishing site engaged in brand impersonation targeting the cryptocurrency platform base. It presents itself as an 'Investor Dashboard | True Foundation' to deceive users into connecting wallets, enabling wallet-draining attacks without using a known drainer kit. As of the latest verification, truefoundation-claim.xyz has been taken offline, though it previously posed an elevated risk to users.

Technical indicators confirm the malicious nature of truefoundation-claim.xyz. The domain was flagged by 1 of 95 VirusTotal security vendors, including Gridinsoft, which assigned a trust score of 0 out of 100. It appears on 2 security blocklists, specifically PhishDestroy and ScamSniffer. Registered through OwnRegistrar, Inc. on September 18, 2025, the domain resolved to the IP address 104.21.49.65, hosted by Cloudflare, Inc. (AS13335) in the US. No SSL certificate was issued, and the nameservers were edward.ns.cloudflare.com and raquel.ns.cloudflare.com. Google Safe Browsing did not flag the domain at the time of analysis.

Users who interacted with truefoundation-claim.xyz should immediately revoke any token approvals granted to the site and transfer funds to a new wallet to prevent unauthorized access. Enable two-factor authentication (2FA) on all accounts and monitor for suspicious transactions. Report the phishing domain to the impersonated brand, base, and submit it to platforms like PhishTank or Google Safe Browsing for broader awareness and mitigation.