supreformfoundation[.]org

The domain supreformfoundation.org is an active phishing site engaged in brand impersonation targeting Discord users. It presents itself as a 'Superform Airdrop' to deceive victims into connecting wallets, posing an elevated risk of wallet credential theft without deploying a drainer kit. As of the latest verification, supreformfoundation.org remains operational and continues to impersonate Discord, a known vector for wallet_connect_phish scams.

Technical indicators confirm the malicious nature of supreformfoundation.org. The domain is flagged by 2 of 95 VirusTotal security vendors, including Fortinet and SOCRadar, and appears on 3 security blocklists (PhishDestroy, MetaMask, and SEAL). Registered through NiceNIC International Group Co., Limited on February 21, 2026, it resolves to IP address 188.114.97.3, hosted on Cloudflare (AS13335) in the US. The SSL certificate is issued by Google Trust Services (WE1), and the site employs HSTS, Cloudflare, and HTTP/3 technologies. Despite these security measures, the domain returns an HTTP 403 status, a common tactic to evade automated detection while remaining accessible to targeted victims.

Victims of supreformfoundation.org should immediately revoke any token approvals granted to the site and transfer funds to a new wallet to prevent unauthorized access. If credentials were entered, change passwords for associated accounts, enable two-factor authentication, and monitor for fraudulent activity. Report the phishing domain to Discord’s official abuse channels, as well as to Google Safe Browsing, PhishTank, and local cybersecurity authorities to aid in takedown efforts.