suprformfoundation[.]org

The domain suprformfoundation.org was registered on February 21, 2026 through NiceNIC International Group Co., Limited and currently resolves to the Cloudflare address 188.114.96.3, located in the United States under ASN 13335. The site presents an HTTP 301 redirect and serves a TLS certificate issued by Google Trust Services under the WE1 identifier, indicating a valid‑looking HTTPS endpoint. Analysis of the page title reveals the text "Superform Airdrop," which aligns with the observed phishing kit classification as an Airdrop Scam targeting wallet or seed credentials.

The infrastructure employs Cloudflare services, including HSTS and HTTP/3, and is referenced by the authoritative nameservers clara.ns.cloudflare.com and marvin.ns.cloudflare.com. Threat intelligence flags the domain as a high‑risk brand impersonation of Discord, and the Gridinsoft trust score of 0/100 corroborates its malicious intent. VirusTotal records a single positive detection out of 93 security vendors, and the domain appears on three external blocklists—PhishDestroy, MetaMask, and SEAL—demonstrating that multiple defensive platforms have already taken mitigation actions.

While the available data confirms the presence of a wallet‑seed phishing campaign, details about the exact payload, user‑interaction flow, or any additional hosting artifacts remain unverified. Defenders should block the resolved IP address and the domain at perimeter filters, enforce DNS sinkholing for the identified nameservers, and update endpoint security signatures to reflect the single vendor detection. Continuous monitoring of Cloudflare‑hosted assets associated with ASN 13335 is advised, as the attacker may pivot to additional subdomains or rotate certificates while retaining the same infrastructure.