h-auth-v3[.]app

Analysis of h-auth-v3.app indicates a high‑confidence brand‑impersonation campaign targeting the Foundation brand. The domain was registered on February 21, 2026 and hosts a page titled "Swap Raydium," a phrase commonly associated with cryptocurrency swapping services. The site employed a TLS certificate identified as WE1, but the certificate details have not been disclosed. Network resolution points to 172.64.146.19, an address owned by Cloudflare, Inc. (AS13335) and geolocated to the United States.

The hosting provider is therefore a well‑known content delivery network, a typical choice for fast‑flux or evasive phishing infrastructure. Security telemetry shows a Gridinsoft trust score of 0 out of 100, indicating a malicious classification. Two of ninety‑three VirusTotal scanners flagged the domain, confirming the presence of malicious indicators. The domain appears on a single external blocklist and has been blocked by PhishDestroy, confirming its active abuse status.

The campaign is classified as wallet/seed phishing, suggesting the page likely attempts to harvest cryptocurrency wallet credentials or seed phrases, although the exact payload has not been captured. Defenders should update URL filtering and DNS blocklists to include h-auth-v3.app, enforce strict TLS inspection to detect any certificate anomalies, and monitor for any related subdomains or look‑alike registrations. Incident response teams should treat any credential submissions to this domain as compromised and advise affected users to rotate wallet secrets immediately. The current offline status does not guarantee cessation of activity; continued observation of the underlying IP and associated Cloudflare assets is recommended.