- Scam type: Phishing
- Project or site name: Foundation Wallet (Passport hardware wallet) phishing emails
- Incident date: 2026-10-27
- Reported: 2026-10-27
- Last updated: 2026-10-27
Security Alliance (SEAL) reported on 2026-10-27 four domains collected from phishing emails sent through the Foundation Wallet mailer service, part of what SEAL calls a Foundation wallet seed-phishing wave. Foundation makes the Passport hardware wallet. Domains named by SEAL: foundationwallet[.]xyz foundation[.]support foundation[.]com[.]im foundationdevices[.]xyz SEAL says three of the domains sit behind DDoS-Guard proxies (186.2.163[.]88, 186.2.163[.]185, 186.2.163[.]189), and one leaked a real server address (95.129.237[.]223) that SEAL connects to older phishing campaigns aimed at SafePal…
Websites in this report: foundationwallet.xyz, foundation.support, foundation.com.im, foundationdevices.xyz