foundaiton[.]sbs

Analysis of foundaiton.sbs indicates that the domain was registered on February 21, 2026 and is currently resolved to the Cloudflare address 104.21.37.117, which is advertised as belonging to AS13335 in the United States. The site presents a HTTP 404 response with the page title “404 Not Found”, suggesting that the original content has been removed or the infrastructure was taken down. Despite the offline status, threat‑intel feeds have marked the domain as malicious: three independent security blocklists list it, and it is explicitly blocked by the PhishDestroy, MetaMask, and SEAL filters.

VirusTotal reports that seven out of ninety‑three scanning engines flagged the domain, confirming a subset of detection confidence. The SSL certificate presented for the host is labeled “WE1”, and the Gridinsoft trust scoring system assigns a rating of zero out of one hundred, indicating a lack of trust. The convergence of blocklist presence, multiple vendor detections, a null trust score, and the Cloudflare hosting pattern aligns with typical infrastructure used for generic phishing campaigns.

Because the active payload is no longer reachable, immediate risk to end‑users is reduced, yet the domain remains a viable indicator of compromise for any residual phishing emails that may still reference it. Defenders should ensure that the domain is added to network‑level deny lists, monitor DNS queries for any resurgence, and review inbound email logs for references to the domain or its IP address. Continuous re‑evaluation is advised in case the infrastructure is re‑hosted elsewhere.