burniesenders[.]sbs

The domain burniesenders.sbs was registered on 2026-04-11 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently flagged as a high-risk, active generic phishing operation. The site returns an HTTP 403 response, indicating that the web server is deliberately restricting access, a pattern often used to hide malicious content from casual inspection while still serving phishing payloads to targeted victims. Infrastructure analysis shows the domain is hosted behind Cloudflare, with authoritative nameservers june.ns.cloudflare.com and nikon.ns.cloudflare.com. DNS resolution points to IP address 188.114.96.3, which resolves to Cloudflare, Inc. in Canada. A Let's Encrypt certificate (issued by the E7 intermediate) secures the site, confirming the presence of a valid TLS endpoint and suggesting the operators are employing encrypted channels to evade network-level detection. Reputation data reinforces the malicious classification. Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal reports that 6 out of 95 security vendors have flagged the domain. The domain appears on three known blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL. These independent signals collectively confirm a concerted phishing campaign targeting users through the burniesenders.sbs namespace. Defenders should immediately block network resolution and TLS connections to burniesenders.sbs and its associated IP address. Email gateways and web proxies should be configured to deny any traffic to the domain. Continuous monitoring of Cloudflare DNS changes is advised, as the attackers may shift to alternate IPs while retaining the same domain. Incident response teams should also review recent user reports for potential credential compromise linked to this domain.