superior-returns[.]net

Analysis of superior-returns.net shows a newly created domain (registered on January 02, 2025) that is currently active and appears to be used for generic phishing. The site is hosted on IP address 91.235.142.249 and is fronted by Cloudflare, with the TLS certificate issued by Let’s Encrypt. Technical fingerprints reveal a WordPress stack backed by MySQL and PHP, with client‑side libraries including UIKit, Swiper, jQuery and an Nginx web server. The domain is delegated to the nameservers ns21.v-sys.org and ns22.v-sys.org.

Registration was performed through NameSilo, LLC. Intelligence sources indicate that the domain has been referenced in two AlienVault OTX pulses and is listed on one public security blocklist. PhishDestroy has already blocked the domain, and VirusTotal has recorded scans from 91 vendors, none of which flagged the site at the time of scanning; this absence of detections does not constitute a safety assurance. The page title returned by the web server is “Superior-returns - Home,” but no further content analysis is available.

Given the combination of a recent registration, active hosting, use of a legitimate‑looking TLS certificate, and placement on multiple threat feeds, the domain should be treated as a malicious phishing infrastructure. Defenders are advised to add superior-returns.net to URL filtering policies, block the associated IP address, monitor for any outbound connections to the domain, and consider sharing the indicator with upstream threat‑intelligence platforms. Ongoing observation is required to determine whether additional payloads or credential‑harvesting pages are deployed behind the front‑end site.