stream[.]cyfdg[.]sbs

Analysis of the domain stream.cyfdg.sbs indicates it is an active phishing site targeting user credentials. Registered on July 8, 2025, through Dynadot LLC, the domain resolves to IP address 38.46.13.38, hosted on AS9294 (GNET INC.) in Hong Kong. The domain uses nameservers ns1.dnsip.com and ns2.dnsip.com and presents a Let's Encrypt SSL certificate issued under the YR2 configuration, which is consistent with short-lived phishing infrastructure. As of July 12, 2026, the domain remains active, returning an HTTP 200 status. The page title, 'stream.cyfdg.sbs,' does not reveal a specific brand target, and no phishing kit or scam category has been confirmed through available metadata. However, the domain appears on one security blocklist and is flagged by 14 of 93 security vendors on VirusTotal, supporting its classification as malicious. The short registration lifespan—less than one year—aligns with patterns observed in disposable phishing domains. Defenders should treat this domain as high-risk for credential harvesting. Network-level blocking is recommended, particularly for organizations with users accessing streaming or media-related services, given the suggestive domain naming. Further analysis of the site content may clarify the targeted brand or service, but current evidence supports immediate containment measures.