ssuperformfoundation[.]org

This domain is flagged as a high-risk brand impersonation threat targeting Discord users through a fraudulent airdrop scheme. Analysis indicates the site mimics legitimate crypto giveaways to deceive victims into connecting wallets or submitting credentials, likely leading to asset theft or account compromise. Infrastructure analysis reveals the domain ssuperformfoundation.org was registered on February 21, 2026, through NiceNIC International Group Co., Limited. It resolves to IP 104.21.70.118 (Cloudflare, Inc., US), a common proxy service used to obscure malicious infrastructure. The domain appears on three security blocklists and is detected by 16 of 95 vendors on VirusTotal. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider often exploited by threat actors to appear trustworthy. The page title 'Superform Airdrop' directly references a fake token distribution event, a tactic frequently associated with crypto drainers. Mitigation requires immediate blocking of the domain and IP at network and endpoint levels. Users should be warned against interacting with unsolicited airdrop promotions, particularly those requiring wallet connections or login credentials. Security teams should monitor for related domains registered under NiceNIC or resolving to Cloudflare IPs, as these may indicate follow-up campaigns. Verify all crypto giveaways through official brand channels before engagement, and report suspicious domains to relevant threat intelligence platforms for broader protection.