gbfe[.]cyrb[.]live

Analysis of the domain gbfe.cyrb.live indicates an active generic phishing infrastructure. The domain is registered through Global Domain Group LLC and is served via Cloudflare, using the nameservers sierra.ns.cloudflare.com and aaron.ns.cloudflare.com. DNS resolution points to IP address 104.21.89.247, which belongs to AS13335 Cloudflare, Inc., located in the United States. The site presents an HTTP 526 response, conveying an "Invalid SSL certificate" error, while the SSL certificate in use is issued by Let’s Encrypt. The page title returned by the server matches the error, reading "cyrb.live | 526: Invalid SSL certificate." Security posture is poor: Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal reports 12 detections out of 94 scanned vendors. The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy mitigation service. Observed technologies include Cloudflare and HTTP/3. While the exact phishing payload and target brand are not disclosed in the available data, the combination of a high‑risk classification, active blocklist presence, and multiple vendor detections confirms malicious intent. Defenders should block the domain at the network perimeter, add it to endpoint allow‑list exclusions, and continue monitoring DNS queries for related subdomains. Ongoing intelligence collection is recommended to identify any associated command‑and‑control hosts or credential‑harvesting pages that may emerge.