claim[.]superformportal[.]icu

PhishDestroy identifies claim.superformportal.icu as an active crypto drainer targeting cryptocurrency users through deceptive web forms and wallet connection prompts. This domain mimics legitimate crypto platform interfaces to trick visitors into connecting wallets or entering seed phrases, resulting in unauthorized crypto asset transfers. Current threat status is active, with evidence of ongoing campaigns observed in the wild.

This domain was flagged by 1 of 95 VirusTotal vendors as of seed 882dda, indicating it remains under the radar despite active distribution. The domain resolves to IP address 172.67.135.85 and is registered through PDR Ltd. d/b/a PublicDomainRegistry.com. Registered on March 28, 2026, the domain uses a Let's Encrypt SSL certificate to appear legitimate. Trust scores remain low due to the recent registration and lack of historical reputation data, with no confirmed blocklist presence at this time.

Security researchers and users are advised to block access to claim.superformportal.icu immediately and avoid interacting with any associated links or web forms. If you have recently connected a wallet or entered credentials on this domain, revoke all connected permissions and transfer remaining assets to a secure wallet. Monitor transaction histories closely and report any unauthorized transfers to relevant authorities. Use updated ad-blockers, browser security extensions, and DNS filtering services to prevent future exposures.