supeformfoundation[.]org

The domain supeformfoundation.org is currently flagged as an active brand impersonation threat targeting Discord users. Analysis indicates this site operates under the guise of a "Superform Airdrop," a common tactic to deceive users into disclosing sensitive credentials or wallet information. The specific threat type is credential harvesting through fraudulent airdrop promotions, leveraging Discord’s reputation to lend legitimacy to the scheme. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with abusive registrations. It resolves to the IP address 172.67.223.98 and is flagged by 5 of 95 security vendors on VirusTotal, including detections for phishing and malicious content. The domain appears on 3 security blocklists, further corroborating its malicious classification. Technical telemetry shows the site employs Cloudflare for hosting, utilizes HTTP/3 and HSTS protocols, and presents a valid SSL certificate issued by Google Trust Services—common obfuscation techniques to evade detection. Current assessments classify this domain as an elevated risk due to its active status and direct targeting of cryptocurrency users. Users encountering this domain should immediately cease interaction and report it to their security providers. Organizations are advised to block the domain and its associated IP at the network level. Individuals who may have engaged with the site should rotate credentials, enable multi-factor authentication, and monitor financial accounts for unauthorized activity. Proactive monitoring of newly registered domains with similar patterns—particularly those impersonating Discord or offering airdrops—is recommended to mitigate further exposure.