# webmail.sfr-inc.com: Recorded Hebrew cPanel Webmail Login Page | PhishDestroy Content language: English Canonical HTML report: https://phishdestroy.io/domain/webmail.sfr-inc.com/ Machine-readable companion: https://phishdestroy.io/domain/webmail.sfr-inc.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: Last known active - First observed by PhishDestroy: 2026-11-10 17:04:21 UTC - Selected availability observation: 2026-11-11T11:32:31Z - Stored record updated: 2026-11-11 19:25:49 UTC - VirusTotal detections in the stored snapshot: 12/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: checked_clean ## Stored infrastructure - Observed IP address: 181.214.142.23 - Registrar in stored WHOIS data: NAMECHEAP INC - Registrar country in stored WHOIS data: US - Last stored HTTP status: 200 (observed: 2026-11-11T11:32:31Z) - Registration date in stored WHOIS data: 2000-02-22 19:23:21 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a1c68a-df79-755a-ae7e-5b2d8b4afc72/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/webmail.sfr-inc.com - Certificate Transparency search: https://crt.sh/?q=%25.webmail.sfr-inc.com - Web Archive lookup: https://web.archive.org/web/*/https://webmail.sfr-inc.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Public report package PhishDestroy records webmail.sfr-inc.com as a Hebrew-language cPanel Webmail login page with email and password fields, a login button, and language options. On 2026-09-08, webmail.sfr-inc.com displayed a Webmail login page. The page shows an orange "Webmail" logo above a Hebrew-language form with fields for an email address and password, a blue login button, a password reset link, and a row of language choices including English, Deutsch, and español. A footer credits cPanel, L.L.C. with a 2026 copyright and a Privacy Policy link. The stored VirusTotal domain result reports 12 detections out of 92 engines. DNS8 reported "phishing"; ESET reported "phishing". Package revision: fb0dc5bccbfa69bbc22fb06a7c7eea28f2b68a430faa950893bfb2dd4d81b8c3 Text generated (not scan time): 2026-11-10 18:51:16 Reviewed evidence snapshot: {"domain":"webmail.sfr-inc.com","screenshot_available":true,"capture_contract":"verified-capture-20261102","plain_text_contract":1,"capture_context":{"submitted_host":"webmail.sfr-inc.com","final_host":"webmail.sfr-inc.com","redirects":[],"captured_at":"2026-09-08T09:28:32.705000Z","uuid":"01a08058-df11-77d9-a393-6ffc28da6921","report_url":"https://urlscan.io/result/01a08058-df11-77d9-a393-6ffc28da6921/","sha256":"98be3ad75c44d89109be536b6cebe9b96d5d7e0c2979ebb8d61bf34eaf852fc5","relationship":"own_domain_page"},"redirect_text_policy":"explicit-redirect-v1","virustotal":{"scope":"domain","detections":12,"engines":92,"malicious":12,"suspicious":0,"analysis_date":"2026-11-05","retrieved_date":"2026-11-10","vendor_labels":{"DNS8":"phishing","ESET":"phishing","VIPRE":"phishing","Lionic":"phishing","Sophos":"phishing","CyRadar":"phishing","Webroot":"malicious","Fortinet":"malware","Kaspersky":"phishing","Gridinsoft":"phishing","SafeToOpen":"phishing","alphaMountain.ai":"phishing"},"flagging_vendors":["DNS8","ESET","VIPRE","Lionic","Sophos","CyRadar","Webroot","Fortinet","Kaspersky","Gridinsoft","SafeToOpen","alphaMountain.ai"]},"virustotal_public_summary":"The stored VirusTotal domain result reports 12 detections out of 92 engines. DNS8 reported \"phishing\"; ESET reported \"phishing\".","page_paragraph_target_characters":550} Source facts (timestamps as stored): {"record_id":1904208,"first_recorded_at":"2026-11-10 18:04:21","virustotal":{"source":"VirusTotal","scope":"unknown","result_state":"complete","numerator":12,"denominator":92,"malicious":12,"suspicious":0,"vendors":{"DNS8":"phishing","ESET":"phishing","VIPRE":"phishing","Lionic":"phishing","Sophos":"phishing","CyRadar":"phishing","Webroot":"malicious","Fortinet":"malware","Kaspersky":"phishing","Gridinsoft":"phishing","SafeToOpen":"phishing","alphaMountain.ai":"phishing"},"observed_at":"2026-11-05T14:35:11Z","checked_at":null,"fetched_at":"2026-11-10T17:17:46Z","time_basis":"UTC (provider ISO timestamps)","stored_summary":{"source":"VirusTotal","scope":"unknown","result_state":"observed","numerator":12,"denominator":92,"malicious":null,"suspicious":null,"vendors":["alphaMountain.ai","CyRadar","DNS8","ESET","Fortinet","Gridinsoft","Kaspersky","Lionic","SafeToOpen","Sophos","VIPRE","Webroot"],"observed_at":"2026-11-05 14:35:11","checked_at":"2026-11-10 18:17:46","fetched_at":"2026-11-10 17:17:47","time_basis":"as stored; legacy timezone not established"},"record_source":"phishdestroy.technologies.vt","vendor_labels":{"DNS8":"phishing","ESET":"phishing","VIPRE":"phishing","Lionic":"phishing","Sophos":"phishing","CyRadar":"phishing","Webroot":"malicious","Fortinet":"malware","Kaspersky":"phishing","Gridinsoft":"phishing","SafeToOpen":"phishing","alphaMountain.ai":"phishing"},"vendor_names":["DNS8","ESET","VIPRE","Lionic","Sophos","CyRadar","Webroot","Fortinet","Kaspersky","Gridinsoft","SafeToOpen","alphaMountain.ai"],"stats":{"timeout":0,"harmless":50,"malicious":12,"suspicious":0,"undetected":30}},"google_safe_browsing":{"source":"Google Safe Browsing","state":"checked_clean","verdict":0,"checked_at":"2026-11-10 18:49:03"},"spamhaus":{"source":"Spamhaus","verdict":null,"checked_at":"2026-11-10 20:31:14"},"availability":{"state":"alive","label_key":"availability.active","detail_key":"detail.latest_reachability","params":[],"source":"current_http_probe","record_id":1904208,"scope":"checked_url","observed_at":"2026-11-11T11:32:31Z","http_status":200,"http_observed_at":"2026-11-11T11:32:31Z","stored_http_code":200,"stored_http_observed_at":"2026-11-11T11:32:31Z","legacy_site_status":"alive","supports_outcome_badge":false,"content_classification":"served_at_root","content_classification_at":"2026-11-11T11:32:31Z","registration_state":"unknown","policy":"20261102-dated-availability-v2"}} ## Stored page captures - URLScan · 2026-11-10: https://screenshots.phishdestroy.io/us/01a1c68a-df79-755a-ae7e-5b2d8b4afc72.png Captured: 2026-11-10 17:39:18 UTC Source report: https://urlscan.io/result/01a1c68a-df79-755a-ae7e-5b2d8b4afc72/ SHA-256: a7962021cc4e97f5f939da7c54824527d6cee187dc982260c397211b6ade873f - URLScan · 2026-09-08: https://screenshots.phishdestroy.io/us/01a08058-df11-77d9-a393-6ffc28da6921.png Captured: 2026-09-08 09:28:32 UTC Source report: https://urlscan.io/result/01a08058-df11-77d9-a393-6ffc28da6921/ SHA-256: 98be3ad75c44d89109be536b6cebe9b96d5d7e0c2979ebb8d61bf34eaf852fc5 - URLScan · 2025-11-30: https://screenshots.phishdestroy.io/us/019ad3ad-d98c-721d-a0ba-dbae6250f4b4.png Captured: 2025-11-30 07:33:02 UTC Source report: https://urlscan.io/result/019ad3ad-d98c-721d-a0ba-dbae6250f4b4/ SHA-256: 77ff6f735cd8a3565a07c9b1f2163fe3f66f84169c0595e81b77083705a2941e - URLScan · 2026-03-23: https://screenshots.phishdestroy.io/us/019d1cb7-109b-705c-a0b5-bb7f7c95fc5e.png Captured: 2026-03-23 22:00:59 UTC Source report: https://urlscan.io/result/019d1cb7-109b-705c-a0b5-bb7f7c95fc5e/ SHA-256: 6aff2ac8750b8c31a32b1946649cf17dd6bf4a2de8e90690f0f0c3790a867163 - URLScan · 2026-06-04: https://screenshots.phishdestroy.io/us/019e93ac-1642-74a7-a941-47858e49f622.png Captured: 2026-06-04 17:26:36 UTC Source report: https://urlscan.io/result/019e93ac-1642-74a7-a941-47858e49f622/ SHA-256: 7cc3792a84025e3172b8d816d9c3c059ea4321b9d3e06a0c8f78d4d6fb6ecf3c - URLScan · 2026-07-20: https://screenshots.phishdestroy.io/us/019f8175-f4c9-710c-8658-b9e9281e9299.png Captured: 2026-07-20 21:37:05 UTC Source report: https://urlscan.io/result/019f8175-f4c9-710c-8658-b9e9281e9299/ SHA-256: a7962021cc4e97f5f939da7c54824527d6cee187dc982260c397211b6ade873f - URLScan · 2026-08-21: https://screenshots.phishdestroy.io/us/01a0222c-2dd9-720d-9b6b-6ab2f322b045.png Captured: 2026-08-21 02:35:22 UTC Source report: https://urlscan.io/result/01a0222c-2dd9-720d-9b6b-6ab2f322b045/ SHA-256: a7962021cc4e97f5f939da7c54824527d6cee187dc982260c397211b6ade873f - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/6d2b7398-b1d1-4638-b5e2-3a481ffacf96.png Captured: 2026-11-10 17:19:25 UTC Source report: https://radar.cloudflare.com/scan/6d2b7398-b1d1-4638-b5e2-3a481ffacf96 SHA-256: 8ee1f0eecdc7e6931ce1bd4806b4d5cf7d05b8cf1945a9a3d82f222269297227 - URLQuery: https://screenshots.phishdestroy.io/uq/0d80bc87-0075-4cf1-b41b-8be34bfd8e3a.png Source report: https://urlquery.net/report/0d80bc87-0075-4cf1-b41b-8be34bfd8e3a SHA-256: 53cdeebe73c06f3ce46ee11aeea191eee5439e2dad90b1f3b58de5fc8b02bdf2 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-11-10T17:41:42Z", "uuid": "01a1c68a-df79-755a-ae7e-5b2d8b4afc72", "scanned_at": "2026-11-10T17:39:18Z", "final_url": "https://webmail.sfr-inc.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://webmail.sfr-inc.com/", "from": "http://webmail.sfr-inc.com/", "status": 307 } ], "ip": "181.214.142.23", "ptr": "idl1-buf.webserverdns.com", "ips": [ "181.214.142.23" ], "asns": [ "14670" ], "countries": [ "US" ], "link_domains": [ "go.cpanel.net" ], "doc_hash": "357590753e476aca9e0eaa109e2faf8bf0f8a45e294c7b2b0296a0d87e93d8a3", "globals": [ "DOM", "MESSAGES", "FADE_DURATION", "FADE_DELAY", "AJAX_TIMEOUT", "LOCALE_FADES", "HAS_CSS_OPACITY", "login_form", "login_username_el", "login_password_el", "login_submit_el", "goto_app", "goto_uri", "div_cache", "content_cell", "reset_form", "set_opacity", "toggle_locales", "showIEBanner", "fade_in", "fade_out", "AjaxObject", "_text_content", "_process_parsed_login_success", "login_button", "login_results", "level_classes", "levels_regex", "show_status", "STATUS_TIMEOUT", "reset_status_timeout", "set_status_timeout", "LOGIN_SUBMIT_OK", "do_login", "show_login", "show_select_user", "preload", "IS_LOGOUT", "SubmitPost", "jstz" ], "cookies": [ "webmailsession", "roundcube_cookies", "timezone" ], "tls": { "san": [ "*.dragondice.com", "cpanel.sfr-inc.com", "cpcalendars.sfr-inc.com", "cpcontacts.sfr-inc.com", "daemondice.com", "daemondice.info", "deamondice.com", "deamondice.info", "dragondice.com", "dragondice.info" ], "cipher": "AES_128_GCM", "issuer": "YR1", "subject": "mail.deamondice.co.uk", "protocol": "TLS 1.3", "valid_to": "2027-01-05T01:19:02Z", "valid_from": "2026-10-07T01:19:03Z" }, "domain_age_days": 1562, "apex_age_days": 3056, "tls_age_days": 34, "tls_valid_days": 89, "requests": 14, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-2aab354" ], "score": -83, "malicious": false }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "Apache", "content-type": "text/html; charset=\"utf-8\"", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff" } }, "cf": { "v": 1, "fetched_at": "2026-11-10T17:22:27Z", "uuid": "6d2b7398-b1d1-4638-b5e2-3a481ffacf96", "scanned_at": "2026-11-10T17:19:25Z", "final_url": "https://webmail.sfr-inc.com/", "status": 200, "history": [ { "url": "https://webmail.sfr-inc.com/", "status": 200 } ], "dom_hash": "401ac968d6d01d1856ba3839cee4845b34041f8fe35837dc202cee4f593ad5f1", "doc_hash": "3835d301bf84ce8b895592fc5b79d91cce47006408857fc4f3d71a63aac91485", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "webmail.sfr-inc.com", "type": "A", "value": "181.214.142.23" } ], "dnssec_valid": false, "ip": "127.0.1.27", "whois": { "registrar": "NameCheap, Inc.", "created": "2000-02-22T20:23:21Z", "updated": "2026-01-23T09:27:04Z", "expires": "2027-02-22T20:23:20Z", "nameservers": [ "ns1.webserverdns.com", "ns2.webserverdns.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-11-10T17:17:46Z", "analysis_at": "2026-11-05T14:35:11Z", "stats": { "timeout": 0, "harmless": 50, "malicious": 12, "suspicious": 0, "undetected": 30 }, "detections": { "DNS8": "phishing", "ESET": "phishing", "VIPRE": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Fortinet": "malware", "Kaspersky": "phishing", "Gridinsoft": "phishing", "SafeToOpen": "phishing", "alphaMountain.ai": "phishing" }, "reputation": 0, "registrar": "NAMECHEAP INC", "created": "2000-02-22T20:23:21Z", "expires": "2027-02-22T20:23:20Z", "updated": "2026-01-23T09:27:04Z", "first_seen": "2023-09-28T18:23:12Z", "dns": [ { "ttl": 14400, "type": "A", "value": "181.214.142.23" } ], "dns_at": "2026-11-05T14:36:22Z", "jarm": "15d3fd16d29d29d00042d43d0000001ae0802418786940cae38f1d9eed5b9b", "cert": { "san": [ "*.dragondice.com", "cpanel.sfr-inc.com", "cpcalendars.sfr-inc.com", "cpcontacts.sfr-inc.com", "daemondice.com", "daemondice.info", "deamondice.com", "deamondice.info", "dragondice.com", "dragondice.info" ], "issuer": "Let's Encrypt / YR1", "serial": "58c01d74415a8b822513a47ae85f28734df", "sha256": "844519656edf1ddc6526098666a81901b42dec0bcbb1b4b53655018febd256a8", "subject": "mail.deamondice.co.uk", "valid_to": "2027-01-05T01:19:02Z", "valid_from": "2026-10-07T01:19:03Z", "observed_at": "2026-11-05T14:36:22Z" }, "whois": { "registrar": "NAMECHEAP INC", "registrar_iana_id": "1068", "registrar_url": "http://www.namecheap.com", "created": "2000-02-22T20:23:21Z", "updated": "2026-01-23T09:27:04Z", "expires": "2027-02-22T20:23:20Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "ns1.webserverdns.com", "ns2.webserverdns.com" ], "dnssec": "unsigned" } }, "webcheck": { "v": 1, "fetched_at": "2026-11-10T17:22:46Z", "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-11-10T17:15:40Z", "first": "2023-03-23T11:11:22Z", "changes": 4, "days_archived": 5, "scans_per_day": 0, "avg_page_bytes": 3348 }, "robots_txt": { "agents": [ "*" ], "present": true }, "social_tags": { "title": "Webmail Login" }, "trackers": { "requests": 3 }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 163, "tls": 108, "wait": 424, "connect": 103, "download": 128 }, "response_ms": 926 }, "tls_connection": { "alpn": "http/1.1", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 21, 22, 25, 53, 80, 110, 143, 443, 587, 993, 995 ] }, "carbon": { "bytes": 39183, "co2_grams": 0.0014, "cleaner_than": 42 }, "dns_server": { "ns": [ { "ip": "192.243.105.200", "host": "ns1.webserverdns.com" }, { "ip": "191.96.165.98", "host": "ns2.webserverdns.com" }, { "ip": "181.214.142.23", "host": "idl1-buf.webserverdns.com" } ], "zone": "sfr-inc.com" }, "cookies": { "cookies": [ { "name": "webmailsession", "secure": true, "session": true, "http_only": true, "same_site": "Lax" }, { "name": "roundcube_cookies", "secure": true, "http_only": true, "same_site": "Lax" }, { "name": "timezone", "session": true } ] }, "location": { "ip": "181.214.142.23", "asn": "14670", "org": "WHG Hosting Services Ltd", "city": "Buffalo", "country": "US" }, "ssl": { "issuer": "Let's Encrypt / YR1", "subject": "mail.deamondice.co.uk" }, "dns": { "A": [ "181.214.142.23" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": "SAMEORIGIN", "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": "nosniff", "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "181.214.142.23", "family": 4 }, "redirects": { "chain": [ "https://webmail.sfr-inc.com" ] }, "tech_stack": { "technologies": [ "Apache HTTP Server" ] }, "linked_pages": { "external": [ "https://go.cpanel.net/ie11deprecation", "https://go.cpanel.net/privacy" ], "external_count": 2, "internal_count": 35 }, "whois": { "registrar": "NameCheap, Inc.", "created": "2000-02-22T20:23:21Z", "updated": "2026-01-23T09:27:04Z", "expires": "2027-02-22T20:23:20Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "ns1.webserverdns.com", "ns2.webserverdns.com" ] }, "headers": { "headers": { "server": "Apache", "content-type": "text/html; charset=\"utf-8\"", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff" } } } } ``` Capture recorded with this analysis (source URL, capture time and stored hash): {"url":"https://screenshots.phishdestroy.io/us/01a08058-df11-77d9-a393-6ffc28da6921.png","source":"URLScan","report_url":"https://urlscan.io/result/01a08058-df11-77d9-a393-6ffc28da6921/","captured_at":"2026-09-08T09:28:32Z","sha256":"98be3ad75c44d89109be536b6cebe9b96d5d7e0c2979ebb8d61bf34eaf852fc5","model_image_sha256":"bbb2a55e74fc52ea0370d1ee2ac2bf54c29b27470761bd5b9d4216112c20cb0e","available":true,"content_status":null} ## Complete dated records Availability observations: https://phishdestroy.io/domain/webmail.sfr-inc.com/records.json?source=availability&format=json Source observation history: https://phishdestroy.io/domain/webmail.sfr-inc.com/records.json?source=detections&format=json PhishStats records: https://phishdestroy.io/domain/webmail.sfr-inc.com/records.json?source=phishstats&format=json Sent report records: https://phishdestroy.io/domain/webmail.sfr-inc.com/records.json?source=sent_reports&format=json Report history: https://phishdestroy.io/domain/webmail.sfr-inc.com/records.json?source=report_history&format=json Repeat report records: https://phishdestroy.io/domain/webmail.sfr-inc.com/records.json?source=rereports&format=json Follow-up records: https://phishdestroy.io/domain/webmail.sfr-inc.com/records.json?source=followups&format=json Content observations: https://phishdestroy.io/domain/webmail.sfr-inc.com/records.json?source=content&format=json ## Dated availability observation Latest stored reachability observation ```json { "state": "alive", "label_key": "availability.active", "detail_key": "detail.latest_reachability", "params": [], "source": "current_http_probe", "record_id": 1904208, "scope": "checked_url", "observed_at": "2026-11-11T11:32:31Z", "http_status": 200, "http_observed_at": "2026-11-11T11:32:31Z", "stored_http_code": 200, "stored_http_observed_at": "2026-11-11T11:32:31Z", "legacy_site_status": "alive", "supports_outcome_badge": false, "content_classification": "served_at_root", "content_classification_at": "2026-11-11T11:32:31Z", "registration_state": "unknown", "policy": "20261102-dated-availability-v2" } ```