event[.]superform[.]click

Retained for the record. This text repeats stored detection facts and is not presented as authored analysis.

This domain, event.superform.click, is actively flagged as a high-risk phishing endpoint targeting user credentials. Analysis indicates the domain was registered on April 29, 2026, through Dynadot, LLC, a registrar frequently observed in phishing operations. The domain resolves to IP address 172.67.159.219, hosted behind Cloudflare infrastructure in Canada, which is commonly exploited to mask the true origin of malicious sites. A 403 HTTP status suggests either a restricted access page or an attempt to evade automated detection while maintaining functionality for targeted victims. Infrastructure review reveals the use of Cloudflare nameservers (lia.ns.cloudflare.com and yadiel.ns.cloudflare.com) and a Let's Encrypt SSL certificate (serial E8), providing a veneer of legitimacy. However, the domain appears on at least one security blocklist, and three out of ninety-five security vendors on VirusTotal have flagged it as malicious. The combination of a recent registration date, Cloudflare proxying, and minimal detection coverage suggests an attempt to operate below the threshold of widespread automated detection while remaining accessible to intended victims. Defenders should treat this domain as an active threat. The 403 status does not indicate inactivity but rather a potential evasion tactic; historical patterns show such domains often serve phishing content selectively. Network security teams are advised to block traffic to 172.67.159.219 and monitor for any attempts to access event.superform.click within their environments. Given the domain's short lifespan and low detection rate, additional scrutiny of related subdomains or newly registered domains under superform.click is recommended to preempt further abuse.