superbonusteam[.]com

superbonusteam.com is currently classified as a high‑risk generic phishing site. The domain was registered on May 19 2026 through Spaceship, Inc. and is served by Cloudflare nameservers agustin.ns.cloudflare.com and leia.ns.cloudflare.com. An active HTTPS service is presented using a Let’s Encrypt certificate (R12), and HTTP queries return a 200 status code, indicating a fully functional web front‑end.

The hosting resolves to the IPv4 address 38.180.120.239, which is assigned to 3NT SOLUTIONS LLP in the Netherlands. The same IP appears on three independent security blocklists and has been referenced in sixteen AlienVault OTX threat‑intelligence pulses. VirusTotal analysis shows that eleven of ninety‑five scanned security engines flagged the domain as malicious, reinforcing the phishing assessment.

Observations confirm that the site actively delivers phishing content, though the exact lures and credential‑ harvesting mechanisms have not been publicly disclosed. The presence of a valid TLS certificate reduces suspicion for casual users, while the 200 HTTP response suggests that the site is serving a complete page rather than a placeholder. The recent creation date and rapid appearance on multiple blocklists imply a coordinated campaign rather than a long‑standing infrastructure.

Defenders should block outbound traffic to 38.180.120.239 and add superbonusteam.com to domain blacklists across DNS filtering solutions. Continuous monitoring of SSL certificate changes and DNS records is advised, as the infrastructure could be shifted to additional IPs or registrars. Incident response teams should inspect logs for any authentication attempts to services that match the brand vectors typically targeted by generic phishing campaigns, and enforce multi‑factor authentication to mitigate credential compromise.