superfformfoundation[.]org

Analysis of the domain superfformfoundation.org, as of July 23, 2026, indicates that it is actively involved in a Wallet/Seed Phishing scam targeting Discord users. The domain was registered on February 21, 2026, and currently appears on four security blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL. This suggests that the domain has been flagged as malicious by multiple security vendors, indicating a high risk level for users who may encounter it. The domain is hosted using Cloudflare, with nameservers 'angelina.ns.cloudflare.com' and 'ray.ns.cloudflare.com'. It resolves to the IP address 188.114.97.3, which is located in the United States and is part of Cloudflare, Inc.'s network (AS13335). The use of Cloudflare and an HTTP/3 protocol can obscure the true origin of the threat and enhance the attacker's ability to maintain the domain's operational status.

The SSL certificate for the domain is issued by Google Trust Services, which may give users a false sense of security. However, the Gridinsoft trust score for the domain is 0/100, indicating a complete lack of trustworthiness. The current HTTP status code is 301, which typically signifies a permanent redirect. This could be used to redirect users to a different malicious site or to mask the true nature of the domain. The page title 'Superform Airdrop' suggests that the domain is part of a phishing kit designed to mimic an airdrop event, a common tactic used to trick users into revealing sensitive information such as wallet seeds or private keys.

The domain impersonates Discord, a popular communication platform often targeted by scammers due to its large user base and the frequent use of airdrops and other cryptocurrency-related activities. Defenders should take immediate action to block this domain and educate users about the risks of wallet/seed phishing scams.