hourglass-fix[.]com

The domain hourglass-fix.com was registered on November 06, 2025 through Web Commerce Communications Limited and resolves to the IPv4 address 185.245.34.139, which is allocated to ZhouyiSat Communications in the United States (AS400992). The site presented the page title “Hourglass - institutional yield for stablecoins.” and was classified as a wallet/seed phishing operation targeting the Foundation brand. The TLS certificate is issued by Let’s Encrypt (certificate identifier E7), and the authoritative name servers are a.dnspod.com, b.dnspod.com, and c.dnspod.com.

Reputation services have flagged the domain: PhishDestroy and ScamSniffer have added it to their blocklists, and a total of 13 of 95 security vendors on VirusTotal reported it as malicious. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on two additional security blocklists. Current probing indicates the domain is offline, and no live HTTP response or content beyond the page title has been captured.

The evidence confirms a deliberate impersonation of the Foundation brand, likely to harvest cryptocurrency wallet credentials. Defenders should immediately block the domain and its associated IP address at network perimeters, update endpoint and URL filtering policies to include the listed blocklists, and monitor the registrar and DNS provider for any re‑registration attempts. Continuous observation of the AS400992 range is advised, as threat actors may reuse the same hosting infrastructure for future campaigns.