superapp[.]zbcn[.]name

Analysis of superapp.zbcn.name indicates the domain was created on 27 February 2026 and is registered through PDR Ltd. d/b/a PublicDomainRegistry.com. The authoritative nameservers are audrey.ns.cloudflare.com and rohin.ns.cloudflare.com, and the domain resolves to IP address 104.21.75.40, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site serves an SSL certificate issued by Let’s Encrypt (certificate identifier E8) and presents the page title “Just a moment…”. Technical profiling shows the presence of Cloudflare Browser Insights, Cloudflare services, and HTTP/3 support.

The domain appears on three public blocklists—PhishDestroy, MetaMask, and SEAL—indicating that at least three independent security entities have flagged it as malicious. VirusTotal records show that the URL was scanned by 93 antivirus and URL‑reputation vendors without generating any detections; however, the lack of detections does not constitute evidence of safety. The current operational status is offline, and no additional page content has been captured, leaving the exact phishing vector and target unknown.

Defenders should continue to block the IP address 104.21.75.40 and the domain name, add it to internal blacklists, and monitor for re‑appearance or related infrastructure. Because the domain uses Cloudflare’s public network, threat actors may repurpose the same IP range for future campaigns, so broader network‑level controls for Cloudflare‑origin traffic are recommended. Ongoing intelligence collection is required to determine the specific credential‑harvesting tactics, any associated command‑and‑control endpoints, and potential victims.