cdn-route-js[.]sbs

The domain cdn-route-js.sbs is currently flagged as a high-risk phishing threat specializing in fake login page scams. Analysis indicates the site is designed to harvest user credentials through deceptive authentication portals, with the page title explicitly displaying 'Log in' to mimic legitimate services. No specific brand impersonation is confirmed, but the infrastructure aligns with credential theft campaigns targeting generic login interfaces. The domain remains active and operational as of this assessment. Infrastructure analysis reveals critical indicators of compromise. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on June 27, 2026, an unusual future date suggesting potential registration data manipulation. It resolves to the IP address 172.67.141.39, hosted behind Cloudflare infrastructure, which is commonly exploited to obscure malicious origins. VirusTotal detection metrics show 7 of 95 security vendors flagging the domain as malicious, with behavioral analysis confirming phishing-related activities. The SSL certificate issued by Google Trust Services provides a false sense of security while failing to validate the site's legitimacy. Current assessment confirms cdn-route-js.sbs remains an active threat. Users are strongly advised to block all connections to this domain and its associated IP address 172.67.141.39 at the network perimeter. Security teams should prioritize monitoring for any authentication attempts originating from this domain, particularly those matching the 'Log in' page pattern. Given the future-dated registration and Cloudflare obfuscation, additional scrutiny of domains registered through the same registrar is recommended. Immediate revocation of any credentials potentially exposed through this domain is critical to prevent account takeovers.