global-infra[.]sbs

This domain, global-infra.sbs, operates as a credential harvesting phishing site designed to deceive users by impersonating Cloudflare security challenges. The page title 'Attention Required! | Cloudflare' suggests an attempt to exploit trust in Cloudflare's infrastructure, likely presenting fake login prompts or CAPTCHA forms to capture sensitive authentication details. Such tactics are commonly employed to bypass multi-factor authentication or gain unauthorized access to corporate or personal accounts. Analysis indicates the domain exhibits multiple high-risk indicators. Registered through NiceNIC International Group Co., Limited on February 21, 2026, global-infra.sbs resolves to the IP address 104.21.83.243, hosted on AS13335 Cloudflare, Inc. infrastructure. The absence of an SSL certificate further undermines its legitimacy. VirusTotal detection metrics report 18 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist, specifically PhishDestroy. The creation date discrepancy, set in the future, is a known tactic to evade automated domain reputation checks. Users who have interacted with global-infra.sbs should immediately revoke any credentials entered on the site and monitor associated accounts for unauthorized activity. Network administrators are advised to block the domain and its resolving IP address, 104.21.83.243, at the perimeter level. Affected systems should undergo a thorough security review to detect potential compromise, including checking for unauthorized access or data exfiltration. Given the domain's active status and high-risk classification, continued vigilance is recommended to mitigate further exposure.