treasury-hyperfoundation[.]com

The domain treasury-hyperfoundation.com was registered on February 21, 2026 and has since been associated with an NFT‑related phishing campaign. Analysis by multiple threat‑intelligence sources indicates that the site was flagged by PhishDestroy and appears on a single security blocklist, confirming that it has been identified as malicious by at least one external mitigation service. VirusTotal scans show that 15 of 95 security vendors recorded a detection for the domain, providing independent corroboration of its threat profile.

The intelligence label classifies the activity as an "NFT Scam," suggesting that the operator likely targeted victims by promising counterfeit or unauthorized non‑fungible tokens in exchange for personal credentials or cryptocurrency payments. Current monitoring reports list the domain as taken offline, which may indicate that the active hosting infrastructure has been shut down or is no longer reachable. However, the historical evidence of blocklist inclusion and vendor detections remains relevant for defensive posture.

Defenders should continue to block any DNS resolution attempts for treasury-hyperfoundation.com, add the domain to internal allow‑list exclusions, and monitor for any resurgence or re‑registration attempts. Further investigation into the hosting IP, SSL certificate details, and page content is warranted, but such data has not been disclosed in the available intelligence. Until more granular artifacts are obtained, the domain should be treated as high‑risk and incorporated into existing phishing and NFT‑scam mitigation controls.