sfr-mail-36ae90[.]webflow[.]io

The domain sfr-mail-36ae90.webflow.io is flagged as a credential theft site. No specific brand impersonation or crypto drainer kit is identified, but the domain's infrastructure and security flags indicate a high risk of phishing activities. The domain was registered through NameCheap, Inc. and currently resolves to the IP address 104.18.36.248, which is located in the United States and is part of the AS13335 Cloudflare, Inc. network.

Infrastructure analysis reveals that the domain has been flagged by 18 out of 95 security vendors on VirusTotal, indicating a significant level of suspicion. The domain was created on February 22, 2026, and its SSL certificate is issued by Google Trust Services / WE1. The domain appears on one security blocklist, specifically PhishDestroy, and has been taken offline as of the latest assessment.

The current status of the domain is offline, which reduces the immediate risk to users. However, the domain's history and existing security flags suggest that it may be reactivated or repurposed for further malicious activities. It is recommended that security teams continue to monitor this domain and consider adding it to internal blocklists to prevent future access. Additionally, users should be educated on the signs of phishing and encouraged to report any suspicious activity related to this domain.