themetisfoundation[.]org

The domain themetisfoundation.org was registered on 21 February 2026 through GoDaddy.com, LLC and is hosted on infrastructure owned by Network Solutions, LLC (ASN 19871). DNS resolution points to the IPv4 address 108.167.173.246, which geolocates to the United States. The domain is served over HTTPS using a Let’s Encrypt certificate (R12), and HTTP requests return a 200 status code, indicating an active web service. Technical fingerprinting shows the site runs WordPress on a PHP/MySQL stack, with the ZURB Foundation front‑end framework, and is fronted by both Nginx and Apache HTTP Server. The authoritative name servers are hgns1.hostgator.com and hgns2.hostgator.com. Threat intelligence tags the site as an NFT scam, and it appears on the PhishDestroy blocklist. VirusTotal analysis reports that 6 of 95 scanning engines flag the domain as malicious, and Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. Publicly available data does not include a content scrape, so the exact phishing page layout, credential collection mechanisms, or malicious payloads remain unknown. While the site is identified as an NFT‑related scam, the specific lures, targeted victim profiles, or transaction flows have not been disclosed. No additional blocklist entries beyond PhishDestroy are currently observed, and the domain’s short lifespan (created less than five months ago) suggests a rapidly deployed campaign. Defenders should immediately add 108.167.173.246 and the domain themetisfoundation.org to network deny lists and email filtering rules. Continuous monitoring of DNS queries for the domain and its name servers is advised, as the infrastructure could be repurposed for further malicious activities. Given the low trust score and multiple security vendor detections, future traffic to this host should be treated as high‑risk, and any user‑initiated connections should be blocked or sandboxed pending deeper analysis.