claim[.]superformfoundations[.]life

On July 24, 2026, the domain claim.superformfoundations.life was observed to be associated with a crypto‑drainer campaign. The site presented the page title “Un instant…”, but no TLS certificate was deployed, indicating an unencrypted HTTP service. DNS resolution points to IP address 172.67.167.166, which belongs to AS13335 owned by Cloudflare, Inc., and the hosting location is identified as the United States. The domain was registered through Cloudflare, Inc., a common registrar for fast‑flung malicious infrastructure.

Threat intelligence flags the domain as a crypto scam, and one security blocklist currently lists the domain, with PhishDestroy confirming the block. VirusTotal analysis shows that 1 of 95 scanned security vendors flagged the domain as malicious, reinforcing the suspicion of illicit activity. Gridinsoft’s trust score for the domain is 0 out of 100, the lowest possible rating, further indicating a high confidence of abuse. The domain’s current operational status is offline, suggesting that the malicious site has been taken down or is no longer serving content.

However, the underlying infrastructure—Cloudflare‑proxied IP address and lack of TLS—remains reusable for future campaigns. Defenders should continue to block the domain at network perimeter devices, add the associated IP address to deny lists, and monitor for re‑registration or similar domains using the same hosting provider. Because the site is presently offline, any ongoing credential or cryptocurrency‑drain attempts are likely halted, but threat actors may re‑activate the domain or clone the infrastructure. Continuous observation of Cloudflare‑hosted IP ranges and rapid response to new detections are recommended.