sephora-jobs[.]com

Analysis of sephora-jobs.com shows a newly registered domain created on 12 June 2026 that is currently active and associated with a generic phishing campaign. VirusTotal reports that four of ninety‑one scanning engines have flagged the domain, indicating that at least a minority of security products recognize malicious characteristics. The domain is listed on a single external blocklist and is actively blocked by the PhishDestroy service, providing additional confirmation of its abusive use.

No publicly available information on the hosting provider, IP address, autonomous system number, or SSL certificate has been disclosed, and page‑title data has not been shared, so infrastructure details remain limited. The short age of the domain combined with early detection by multiple vendors suggests an opportunistic phishing operation that likely targets users of the Sephora brand by leveraging the “jobs” sub‑domain to lure victims into credential‑ harvesting flows. Defenders should add sephora-jobs.com to deny‑list rules across DNS, web‑proxy, and endpoint protection systems, and monitor for any outbound connections to the domain’s IP space once resolved.

Ongoing intelligence gathering should focus on retrieving the hosting IP, TLS certificate fingerprints, and any observed HTTP response codes to refine detection signatures. Until further evidence emerges, the domain should be treated as high‑risk and blocked at the network perimeter.