superformfoundation[.]sbs

This domain is flagged as an elevated-risk generic phishing infrastructure designed to impersonate foundation or nonprofit payment portals. Analysis indicates the site was engineered to harvest financial credentials or redirect victims to fraudulent donation gateways, though no specific brand impersonation has been confirmed. The threat type falls under broad credential theft rather than targeted brand spoofing. Infrastructure analysis reveals the domain superformfoundation.sbs was registered on February 21, 2026, through NiceNIC International Group Co., Limited. It currently resolves to IP address 172.67.140.103 and has been detected by 8 out of 95 security vendors on VirusTotal. The domain appears on three security blocklists and holds a Gridinsoft trust score of 0/100. Access attempts return a page titled 'Just a moment...', a common indicator of cloaking or intermediate redirect mechanisms. The domain has been blocked by MetaMask, SEAL, and PhishDestroy, and is now offline. Mitigation for this threat type requires immediate action from network defenders. Organizations should add the domain and associated IP (172.67.140.103) to web proxy and DNS blocklists. Security teams should review logs for connections to the domain or IP since its creation date, particularly from systems handling financial transactions or donor portals. End users should be alerted to verify payment destinations through official channels only, especially when prompted by unsolicited messages referencing foundations or nonprofits. Given the domain's offline status, monitoring for re-emergence under similar naming patterns is recommended.