sfasfsaf12412s[.]cfd

This domain sfasfsaf12412s.cfd was registered through NameSilo, LLC on 26 February 2026 and points to the Cloudflare edge address 172.67.141.245, which is announced by AS13335 (Cloudflare, Inc.) and geolocated to the United States. The authoritative nameservers are isla.ns.cloudflare.com and razvan.ns.cloudflare.com, indicating that the domain is hosted entirely within Cloudflare’s CDN infrastructure. No TLS certificate was presented when the site was queried, confirming the absence of HTTPS protection. The site is currently taken offline, but historic observations recorded a page title of “Token Distribution”, which aligns with the declared “Airdrop Scam” kit and the impersonation of the blockchain project Sei.

VirusTotal recorded a single positive detection out of 93 scanned scanners, and the domain appears on three external blocklists. Additional protective services such as PhishDestroy, MetaMask and SEAL have also listed the domain as malicious. The limited detection footprint suggests that the campaign is either newly deployed or deliberately low‑profile, and the single vendor flag indicates that at least one security product recognized the malicious intent. Because the domain resolves to a shared Cloudflare IP, traditional IP‑based blocking may affect legitimate traffic, so defenders should rely on domain‑level indicators, including the exact hostname, the observed nameservers, and the page title fingerprint.

Monitoring for re‑registration or resurrection of the domain is recommended, and any inbound requests to sfasfsaf12412s.cfd should be blocked at the DNS or proxy layer. The absence of an SSL certificate and the offline status limit immediate payload analysis, so further investigation should focus on retrieving archived page content or network captures if the site reappears. Until then, the domain should be treated as a confirmed Sei‑impersonating airdrop phishing vector.