superfluidapp[.]live

The domain superfluidapp.live was registered on 2026-03-06 through NiceNIC International Group Co., Limited and resolves to the Amazon-owned address 216.198.79.1 (AS16509, United States). The site presents the page title “SuperFluid | Claim SUP App” and is classified as an investment‑scam phishing campaign. Infrastructure analysis shows the domain is served via Cloudflare DNS (betty.ns.cloudflare.com, ashton.ns.cloudflare.com) and uses a Let’s Encrypt R12 certificate, indicating standard TLS encryption without obvious certificate anomalies.

The host IP is listed on two security blocklists, PhishDestroy and ScamSniffer, and the domain appears on two additional blocklists, reinforcing its malicious reputation. VirusTotal reports that the domain was scanned by 94 vendors, none of which raised a detection at the time of analysis; this lack of detections does not constitute a safety guarantee. As of the report date, the site has been taken offline, and HTTP probes return no active content.

Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑activation of the IP address, and incorporate the observed indicators—domain name, registration date, IP, nameservers, SSL fingerprint, and blocklist entries—into threat‑intel feeds. Ongoing vigilance is advised because the underlying hosting provider (Amazon) may be reused for other malicious campaigns, and the rapid registration-to‑deployment timeline suggests a low‑cost, automated phishing operation. No further artifacts such as malware payloads or credential‑stealing pages have been observed, so the primary mitigation focus remains on preventive blocking and alerting on any future resolution to the same infrastructure.