app-vision[.]xyz

Analysis of app-vision.xyz shows a newly registered domain (created 21 Feb 2026) that has been taken offline but was previously used to host a fake airdrop campaign impersonating the “foundation” brand. The site presented the page title “Vision”, a detail that aligns with the supplied intelligence but no further content has been captured. Infrastructure inspection reveals the domain resolves to 18.222.140.9, an address owned by Cloudflare (ASN 13335) located in the United States. The domain is delegated to Cloudflare name servers kimora.ns.cloudflare.com and woz.ns.cloudflare.com, indicating the attacker leveraged a reputable CDN to hide the origin server. No TLS certificate was observed, leaving the site without HTTPS protection.

Reputation services assign a Gridinsoft trust score of 0 / 100, effectively flagging the host as malicious. The domain appears on three external blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, confirming that multiple threat intelligence feeds have identified it as hostile. VirusTotal scans show that six of ninety‑three antivirus engines flagged the domain, providing additional corroboration of malicious intent. The registrar listed is NiceNIC International Group Co., Limited, a known registrar used by threat actors for rapid domain acquisition. Because the site is currently offline, direct payload analysis is not possible, and the exact phishing page content remains unknown.

Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration attempts, and add the associated IP address to deny‑list rules. Additional scrutiny of traffic to Cloudflare‑served IP ranges may be warranted, especially for connections originating from internal users that could indicate attempts to reach a revived version of the campaign.