37737[.]live-security-checkmarks365[.]click

Analysis indicates that the domain 37737.live-security-checkmarks365.click was registered on 2026-02-21 and is currently resolved to the IPv4 address 104.21.72.125. The address belongs to Cloudflare, Inc. (AS13335) and is geolocated to the United States. The domain is listed on a single public security blocklist and has been specifically blocked by the PhishDestroy feed. VirusTotal records show that 13 out of 95 scanning engines have flagged the domain as malicious, reinforcing the suspicion of phishing activity.

The site presented a TLS certificate identified as “WE1”, which is typical for short-lived infrastructure used in credential‑harvesting campaigns. At the time of assessment the HTTP service was reported as offline, and no live page content could be retrieved. Because the domain is no longer reachable, active content analysis could not be performed, leaving the exact phishing lure and target brand unconfirmed. Nonetheless, the combination of recent registration, Cloudflare hosting, blocklist presence, multiple vendor detections, and a non‑standard SSL certificate constitutes a strong indicator of a phishing infrastructure.

Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the associated IP address, and add the IP to any threat intelligence feeds that accept Cloudflare‑originated indicators. Additional scrutiny of outbound traffic to 104.21.72.125 is advised, as compromised hosts may attempt to reuse the same hosting infrastructure for future campaigns. Organizations using automated URL reputation services should ensure the domain is included in their deny lists, and incident response teams should treat any email or message containing this host as malicious until further investigation confirms otherwise.