sephora-careers[.]com

Analysis of the domain sephora-careers.com indicates it is an active phishing site targeting job seekers under the guise of Sephora career opportunities. Registered on June 12, 2026, through Name.com, Inc., the domain resolves to IP address 35.157.26.135, hosted on AWS EC2 infrastructure in Germany (eu-central-1). The page title, 'Careers at Sephora,' suggests an attempt to impersonate the legitimate Sephora careers portal, though the exact content and functionality of the site remain unconfirmed as of this report. Security vendors have flagged the domain, with 16 out of 91 engines on VirusTotal detecting it as malicious. The domain is also blocked by at least one security blocklist, and its Gridinsoft trust score is 0/100, further indicating high-risk activity. The site employs a Let's Encrypt SSL certificate (serial number E8) and returns an HTTP 403 status, which may be an attempt to restrict access to automated scanning tools while remaining operational for targeted victims. Infrastructure analysis reveals the use of Netlify for hosting, alongside HSTS and Google Analytics, which are common in both legitimate and malicious sites but may aid in tracking user interactions. The domain's nameservers (dns1.p08.nsone.net through dns4.p08.nsone.net) are associated with a reputable DNS provider, which does not inherently indicate malicious intent but is consistent with tactics used to evade immediate suspicion. Defenders should treat this domain as high-risk and prioritize blocking it at the DNS or network level. Given its recent registration and active status, monitoring for related domains or IP associations is recommended. The lack of additional context regarding the phishing kit or specific lure tactics limits further attribution, but the combination of job-themed impersonation and security vendor detections warrants immediate mitigation.