verify[.]check3851[.]sbs

This domain, verify.check3851.sbs, was observed delivering a credential‑phishing page that returned the HTML title “Just a moment…”. The domain was registered through Global Domain Group LLC and first appeared on 21 February 2026. DNS queries resolve the name to 188.114.96.3, an address announced by AS13335 Cloudflare, Inc. and geolocated to the United States. The authoritative nameservers are amit.ns.cloudflare.com and candy.ns.cloudflare.com, both standard Cloudflare resolvers. No TLS certificate is presented, so the site operates over unencrypted HTTP.

Reputation scoring from Gridinsoft is 0 out of 100, reflecting an extremely malicious classification. VirusTotal analysis records 13 of 93 antivirus engines marking the domain as malicious, corroborating the credential‑phishing designation. The site has been taken offline, yet it remains listed on at least one public blocklist and is actively blocked by the PhishDestroy service. Because the service is offline, the exact content of the phishing page, including any form fields or target brands, cannot be confirmed at this time.

Defensive recommendations include adding the domain and its IP address to DNS‑based blocklists, enforcing sinkhole redirects for Cloudflare‑hosted IP ranges, and configuring HTTP inspection to capture any residual traffic. The absence of TLS also enables straightforward payload extraction for forensic review. Security teams should propagate the indicator set—domain, IP, nameservers, and registration details—through internal threat‑intel feeds to ensure rapid detection in downstream security controls. Continuous monitoring is advised in case the infrastructure is re‑activated for future credential‑phishing campaigns.