superbridgie[.]app

The domain superbridgie.app was observed being served through Cloudflare's network and is currently marked as offline. VirusTotal records show that ten of ninety‑five scanned security vendors flagged the domain, indicating a non‑trivial level of suspicion. The site presented the page title “Superbridge” and employed HTTP/3, suggesting a modern web stack. DNS resolution points to the IP address 172.67.154.28, which belongs to Cloudflare, Inc. (AS13335) and is geolocated to the United States.

The domain uses Cloudflare‑provided nameservers selah.ns.cloudflare.com and watson.ns.cloudflare.com, and the TLS certificate was issued by Google Trust Services under the WE1 profile, confirming the use of a legitimate certificate chain. Registration details list NICENIC INTERNATIONAL GROUP CO., LIMITED as the registrar, but no further WHOIS timestamps are provided. The domain appears on a single public blocklist, PhishDestroy, and has been flagged by that feed as a generic phishing site. No additional intelligence such as Safe Browsing verdicts, Open Threat Exchange entries, or malware kit identifiers is currently available.

The offline status prevents direct content inspection, so the exact phishing lure, target brand, or credential‑collection mechanism remains unknown. Given the combination of a reputable SSL certificate, Cloudflare hosting, and multiple vendor detections, the infrastructure is consistent with a typical phishing deployment that relies on trusted‑looking TLS to increase victim confidence. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists with the observed indicator, and monitor for any re‑appearance on the same IP or within the same Cloudflare account. Further analysis should be triggered if the domain becomes reachable again, focusing on content capture, credential fields, and any redirects that may reveal the intended victim audience.