mint[.]hypurrnfts[.]org

The domain mint.hypurrnfts.org was registered on 21 February 2026 through Web Commerce Communications Limited operating as WebNic.cc. It resolves to the IPv4 address 23.111.160.242, which is announced by AS29802 HIVELOCITY, Inc. and geolocated to the United States. The TLS certificate presented by the host is identified as “R11”, and a Gridinsoft trust‑score of 0 out of 100 flags the site as highly malicious. The domain is served by the authoritative name servers ns100.webnic.cc and ns101.webnic.cc. Public threat‑intelligence sources list the site on five blocklists – PhishDestroy, ScamSniffer, Polkadot, Enkrypt and Codeesura – and VirusTotal reports that three of ninety‑three scanning engines have flagged the domain.

The page title returned from the HTTP response is “Hyper Foundation”, and the domain is explicitly noted to impersonate the “foundation” brand. The associated scam type is classified as wallet/seed phishing, indicating an attempt to harvest cryptocurrency wallet credentials or seed phrases. Current observations show the site is taken offline, and no additional page content, login forms, or malicious payloads have been captured. Consequently, the precise phishing workflow, redirect chain, or credential‑capture mechanism remains unknown. Absence of Safe Browsing, Open Threat Exchange or other community‑sourced indicators limits the ability to assess the full scope of the campaign.

Defenders should immediately block mint.hypurrnfts.org and its hosting IP 23.111.160.242 at network perimeters, DNS resolvers and endpoint security solutions. Adding the domain to internal blocklists and sharing the indicator set with threat‑sharing platforms will help prevent reuse. Monitoring future registrations that employ the same registrar, name‑server pair, or ASN can reveal related infrastructure. Continuous re‑scanning of the domain, especially after any re‑appearance, is recommended to capture any evolving payload or phishing page.