tnsr[.]foundation

Analysis of tnsr.foundation, created on 2025-11-20 and currently taken offline, reveals infrastructure consistent with a brand-impersonation campaign targeting the foundation brand. The domain is registered through NameSilo, LLC and uses Cloudflare’s authoritative name servers ligia.ns.cloudflare.com and steven.ns.cloudflare.com. DNS resolution points to IP address 104.21.46.123, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. No TLS certificate is presented; HTTP requests return the page title “Just a moment…”, indicating that the site likely served a Cloudflare challenge page rather than bespoke content. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy feed.

VirusTotal scans show that 2 of 95 antivirus engines flagged the domain, suggesting at least limited malicious behavior detected by a minority of vendors. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the low credibility assessment. The documented scam type is “Brand Impersonation”, and the threat actor explicitly claims to impersonate the foundation brand. While the offline status limits immediate exposure, the underlying hosting through a shared Cloudflare IP space implies that future replicas could be launched with minimal configuration changes. Defenders should continue to deny network traffic to 104.21.46.123, add tnsr.foundation to local blocklists, and monitor for new domains that resolve to the same Cloudflare IP range or reuse the same name-server pair.

Continuous observation of VirusTotal, PhishDestroy, and other threat-intel feeds is recommended to capture any resurgence of the campaign. Because the site does not present a valid SSL certificate, any attempt to establish HTTPS connections will fail, providing an additional barrier for automated retrieval.