common[.]foundaition[.]xyz

The domain common.foundaition.xyz was registered on November 29, 2025 through NiceNIC International Group Co., Limited and is currently taken offline. DNS resolution points to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. in the United States. The domain uses Cloudflare nameservers anirban.ns.cloudflare.com and cass.ns.cloudflare.com, but no SSL certificate is observed, indicating that HTTPS connections would be unavailable. Reputation metrics are extremely low; Gridinsoft assigns a trust score of 0 out of 100, and the page title returned by the site is the generic string "Common".

Independent threat intel sources have listed the domain on two security blocklists, and it is actively blocked by PhishDestroy and ScamSniffer. VirusTotal analysis shows that four of ninety‑five security vendors flagged the domain, confirming that at least a minority of scanners consider it malicious. The threat type is categorized as generic phishing, though no specific brand or credential‑stealing page content has been disclosed.

The evidence set is limited to infrastructure and reputation data; no payload, credential‑capture mechanism, or targeted brand has been identified, leaving the exact phishing lure uncertain. Defenders should continue to block the domain at network perimeter and DNS layers, monitor outbound connections to the associated Cloudflare IP, and treat any future re‑activation as potentially malicious. Given the zero trust score, lack of TLS, and multiple blocklist entries, the domain should be considered high‑risk until a thorough content analysis can be performed.