claim-superformfoundation[.]pages[.]dev

This domain, claim-superformfoundation.pages.dev, presents a high-risk brand impersonation threat targeting Ethereum users through a fraudulent $UP token airdrop registration page. The site mimics the Superform Foundation, a known entity in the Ethereum ecosystem, to deceive visitors into disclosing wallet credentials or transferring funds under the guise of an airdrop distribution. The page title, $UP Token Airdrop Registration | Superform Foundation, explicitly leverages the allure of free token distributions, a common tactic in cryptocurrency phishing schemes to exploit user greed and urgency. Analysis indicates the domain is flagged by 10 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly categorizing it as phishing. Infrastructure analysis reveals the domain was registered on December 02, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.47.70, hosted on Cloudflare's network (AS13335). The domain appears on two security blocklists and is actively blocked by at least two anti-phishing tools. The SSL certificate, issued by Google Trust Services (WE1), provides a false sense of security while facilitating encrypted communication for credential harvesting. Users who visited claim-superformfoundation.pages.dev should immediately revoke any wallet permissions granted to the site and transfer assets to a new wallet if credentials were entered. Monitor transaction histories for unauthorized transfers, particularly those involving Ethereum or ERC-20 tokens. Report the incident to relevant blockchain security teams and consider filing a complaint with the domain registrar (Cloudflare) for further takedown actions. Given the domain's current offline status, users should remain vigilant for similar phishing attempts using comparable domain structures or impersonation tactics.