sfinks96[.]biz

The domain sfinks96.biz was registered on 26 March 2026 via NICENIC INTERNATIONAL GROUP CO., LIMITED. Within days of its creation it was observed serving content that triggered a generic phishing classification. The threat rating is high and the domain remains active as of 12 July 2026. Technical reconnaissance shows that sfinks96.biz resolves to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. in Canada. The domain is delegated to the Cloudflare nameservers sandy.ns.cloudflare.com and ishaan.ns.cloudflare.com. HTTPS is enabled with a certificate issued by Google Trust Services under the WE1 profile, but HTTP requests return a 403 status code, suggesting intentional restriction of direct access. The Gridinsoft trust score for the domain is 0 out of 100, indicating a malicious reputation. VirusTotal analysis records 13 detections out of 95 scanned security vendors. Open Threat Exchange (OTX) lists the domain in a single threat‑intel pulse, and it appears on one external blocklist. The domain has also been added to the PhishDestroy blocklist, reinforcing its identification as a phishing vector. Despite the relatively low number of detections, the combination of a fresh registration, zero trust score, Cloudflare hosting, and multiple blocklist entries aligns with the high‑risk profile assigned. Defenders should immediately block sfinks96.biz at network perimeter and DNS resolvers. Continuous monitoring of the associated IP address and the Cloudflare nameservers is advised to detect any pivot or re‑use of the infrastructure. Where possible, sinkholing or redirecting traffic to a safe landing page can reduce user exposure. Incident response teams should also correlate internal logs for any authentication attempts or credential submissions targeting the domain, and update detection signatures to reflect the observed SSL certificate chain and HTTP 403 response pattern.