tnsr.foundation

VirusTotal scans show that 2 of 95 antivirus engines flagged the domain, suggesting at least limited malicious behavior detected by a minority of vendors. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the low credibility assessment. The documented scam type is “Brand Impersonation”, and the threat actor explicitly claims to impersonate the foundation brand. While the offline status limits immediate exposure, the underlying hosting through a shared Cloudflare IP space implies that future replicas could be launched with minimal configuration changes. Defenders should continue to deny network traffic to 104.21.46.123, add tnsr.foundation to local blocklists, and monitor for new domains that resolve to the same Cloudflare IP range or reuse the same name-server pair.

Continuous observation of VirusTotal, PhishDestroy, and other threat-intel feeds is recommended to capture any resurgence of the campaign. Because the site does not present a valid SSL certificate, any attempt to establish HTTPS connections will fail, providing an additional barrier for automated retrieval.