Sneaky fuckers. From my clanker. It's a scam ad that changes what it shows based on who it thinks is looking. You click the ad and land on a "One moment please, verifying the link" page. That page quietly looks up the current scam address from a blockchain contract, so the operator can swap domains at will, then hands you to a lookalike link made three days ago. That site runs a commercial fingerprinting service on you, which checks your browser, device, IP and behavior, and its own server decides whether you look like a real target. If you look like a bot, a researcher or a security scanner, or the check fails at all, it sends you to the real `foundation.xyz`, so anyone investigating sees nothing wrong. That's exactly what happened when I first opened it. If you look like a real victim, you get a fake "Passport recall" that asks for your 12 seed words or gets you to "create a new vault" whose words the attackers already hold. The operator can even ban or redirect specific visitors by hand from an admin panel.