verify[.]form7604[.]sbs

The domain verify.form7604.sbs was registered on 21 February 2026 and currently resolves to the IPv6 address 2606:4700:3034::6815:2c8c, which is announced by Cloudflare, Inc. (AS13335) and geolocated to the United States. The site is listed as offline at the time of this assessment, and the observed HTTP response includes the page title “Just a moment…”, which is typical of Cloudflare challenge pages but does not provide functional content for analysis. Threat intelligence categorizes the domain as a credential phishing operation, and it has been blocked by the PhishDestroy service and appears on one external security blocklist. Gridinsoft assigns a trust score of 0 out of 100, indicating a lack of legitimacy.

VirusTotal analysis shows that eight of ninety‑three scanned security vendors flagged the domain as malicious, reinforcing the phishing classification. The SSL certificate presented is labeled “WE1”, which does not correspond to a recognized public‑trusted authority and further reduces confidence in the domain’s authenticity. No additional evidence such as malware payloads, credential harvesting pages, or redirects were observed, leaving the exact phishing vector unknown.

Defenders should continue to block traffic to the domain at perimeter and DNS layers, add the IPv6 address to existing blocklists, and monitor for any resurgence of the domain or related sub‑domains. Given the Cloudflare hosting, threat actors may rapidly redeploy the domain under the same or similar names, so automated detection rules that flag the “Just a moment…” title combined with low trust scores and the specific phishing tag are recommended. Continuous re‑evaluation of VirusTotal and other sandbox feeds is advised to capture any new detections that could indicate an active campaign.