This repository documents a technical forensic analysis of superxcomputer.com, a platform advertising high-performance AI computing services. Investigation showed the platform to be a task-scam / Ponzi-style operation targeting specific geographic regions, including Romania.
The analysis was performed entirely within an isolated Kali Linux virtual machine, using standard security-audit tooling, for research and public-awareness purposes.
- Burp Suite Professional — intercepting and analyzing API calls and JSON configuration responses
- Browser DevTools — inspecting the Vite/Vue.js frontend and auditing
localStorage - CLI forensics — scanning minified JavaScript for hidden endpoints
- OSINT — identifying hosting infrastructure (Cloudflare-fronted) and inferred origin
The platform enforces a hardcoded default country code (+40, Romania) via /api/v1/site/config, and rejects registration attempts using other country codes at the API level — confirming a deliberately localized targeting strategy rather than a general-purpose global service.
Site configuration data revealed that advertised withdrawal methods (Bank, Revolut) are disabled at the backend (withdrawMethodBank / withdrawMethodRevolut both false), despite being displayed as active options in the UI. An additional hardcoded rule blocks withdrawals on weekends — a common tactic for giving operators a window to move funds before users notice.
Minified JavaScript assets contain zh-CN as the primary language key, and the platform ships translations for 10+ languages — consistent with a reused, white-label scam template deployed per-campaign rather than a bespoke platform.
The platform performs aggressive client-side fingerprinting (canvas fingerprinting, WebGL vendor detection, CPU/core enumeration, screen resolution) via a persistent localStorage object, most plausibly to detect and blacklist repeat visitors or researchers.
Frontend locale state can be forced via localStorage, and does not stay synchronized with backend-enforced regional locks — demonstrating a lack of server-side session/state validation.
| File | Description |
|---|---|
API_exposure.md |
Backend configuration evidence showing the withdrawal "kill-switch" and geo-lock |
fingerprinting.md |
Client-side tracking and hardware fingerprinting techniques in use |
ui_manipulation.md |
Frontend/localization state inconsistencies and dead UI elements |
investigation.md |
Methodology used throughout the investigation |
Note: This repository intentionally does not include a detailed writeup of a suspected authentication-related weakness identified during testing. As the target platform remains active, publishing exploit-level detail on an unresolved issue isn't something I'm comfortable doing here — the general finding is that server-side input validation appeared incomplete, which is consistent with the operation's overall low engineering effort.
For a related incident involving a different phishing pattern (credential theft via a cloned login flow, rather than a fraudulent investment platform), see OpenID-MITM-Phishing-Forensics.
Proofs: imgur.com/a/YF7EQZK
This analysis is for educational and research purposes only. It was conducted to demonstrate security-audit methodology and to warn potential victims about fraudulent investment schemes. No funds were deposited, no real accounts were used, and no destructive testing was performed against the target infrastructure.