sephogifts[.]com

The domain sephogifts.com was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is presently resolved to the Cloudflare IP address 185.158.133.1, which is associated with AS13335 Cloudflare, Inc. in Poland. DNS resolution uses the Cloudflare name servers rita.ns.cloudflare.com and syeef.ns.cloudflare.com, and the site enforces HTTP Strict Transport Security (HSTS). The TLS certificate is issued by Google Trust Services under the WE1 designation, indicating a valid HTTPS endpoint. An HTTP GET request returns a 200 status code and the page title observed is "Sephora Rewards - Unlock Your $750 Exclusive Reward," suggesting the site is being used to lure victims with a fake Sephora rewards offer.

VirusTotal analysis shows that three of ninety‑three security vendors have flagged the domain, and the domain is listed on at least one security blocklist, including PhishDestroy. Independent reputation scoring from Gridinsoft rates the domain at 1 out of 100, reflecting a very low trust level. The infrastructure—Cloudflare front‑end, Polish IP, recent registration, and low trust scores—aligns with typical phishing provisioning.

While the page title provides a clear indication of the targeted brand, the full page content has not been publicly disclosed, leaving the exact credential‑capture mechanisms uncertain. Defenders should immediately block sephogifts.com at network perimeter and endpoint controls, add the associated IP to deny lists, and monitor for other domains hosted on the same Cloudflare IP range. Continuous re‑scanning with multi‑vendor services is advised to capture any evolving detection signals, and any email or URL vectors referencing the Sephora rewards narrative should be treated as malicious.