fabricffoundation[.]xyz

This domain, fabricffoundation.xyz, was observed hosting a page titled “$ROBO Airdrop”. The page title, combined with the classification as a crypto‑scam and the identification of an “Airdrop Scam” phishing kit, indicates that the site was designed to lure victims with a fraudulent cryptocurrency airdrop. The domain was registered on 27 February 2026 and resolves to the IP address 172.67.206.77, which belongs to Cloudflare, Inc. (ASN 13335) located in the United States. Cloudflare’s shared hosting environment is frequently abused for malicious campaigns, and the presence of the domain on three independent security blocklists further corroborates its malicious intent.

The domain’s SSL certificate was reported with an “E8” rating, suggesting a weak or mis‑issued certificate that may be used to lend credibility to the page. VirusTotal scans returned two positive detections out of 93 security vendors, confirming that at least a subset of scanners flagged the domain as malicious. The site has since been taken offline and is currently blocked by PhishDestroy, MetaMask, and SEAL, which are specialized anti‑phishing and wallet protection services.

While the exact content of the landing page has not been captured, the combination of the page title, phishing kit identification, and blocklist listings provides sufficient evidence to classify the domain as an active crypto‑airdrop phishing operation. Defenders should continue to block fabricffoundation.xyz at DNS and network layers, monitor Cloudflare‑origin traffic for related indicators, and update endpoint and browser protection rules to include the observed hash of the SSL certificate and the IP address 172.67.206.77. Because the domain is already offline, immediate containment is less critical, but ongoing observation is recommended to detect any re‑registration attempts or similar domains that reuse the same kit or targeting language.