sueprformfoundation[.]org

This domain, sueprformfoundation.org, is flagged for elevated-risk brand impersonation targeting Discord users through a fraudulent airdrop lure. Analysis indicates the threat type is a crypto asset drainer, designed to deceive victims into connecting wallets to malicious smart contracts under the pretense of a token distribution event. The page title, 'Superform Airdrop,' reinforces the social engineering tactic by mimicking legitimate decentralized finance promotions, a common vector for credential and asset theft in the Web3 ecosystem.

Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk registrations. It resolves to the IP address 188.114.96.3, which is part of a network range previously linked to phishing and malware distribution. Detection metrics show the domain is flagged by 6 out of 95 security vendors on VirusTotal, while three independent blocklists—including MetaMask, SEAL, and PhishDestroy—have classified it as malicious. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy, while the presence of HSTS, Cloudflare, and HTTP/3 suggests the use of modern evasion techniques to bypass basic security checks and improve page load performance.

To mitigate risk, users are advised to avoid interacting with any content hosted on sueprformfoundation.org. Wallet connections should never be authorized on untrusted sites, especially those promoting unsolicited airdrops. Network-level protections, such as DNS filtering or endpoint detection rules, should be configured to block access to the domain and its associated IP. Organizations are encouraged to monitor for internal traffic to 188.114.96.3 and correlate logs with known phishing patterns. Given the domain’s recent registration and active status, continuous monitoring for related infrastructure—such as newly registered domains under the same registrar or IP range—is recommended to preempt further abuse.