safebr1dge[.]ru

Analysis of safebr1dge.ru on 19 July 2026 shows an active generic phishing infrastructure. The domain resolves to the CloudFlare‑hosted address 188.114.97.3, which is geolocated to Canada and is associated with CloudFlare, Inc. An HTTPS connection is established using a certificate issued by Google Trust Services under the WE1 intermediate, indicating a properly signed TLS certificate. The web server returns HTTP 200 and presents the page title “Nexa Meet — видеовстречи для рабочих команд”, suggesting the site is positioned as a video‑conference service for business users, though the page content has not been independently verified. VirusTotal records indicate that 16 of 91 scanned security vendors flag the domain as malicious, and the domain is currently blocked by the PhishDestroy feed and appears on one additional security blocklist. The combination of a CloudFlare front‑end, a valid TLS certificate, and a malicious detection profile points to a typical abuse pattern where legitimate hosting services are leveraged to host phishing pages while evading simple IP‑based blocking. Defenders should add safebr1dge.ru to URL filtering and DNS‑based block lists, monitor for any new resolution changes, and consider sinkholing the IP address 188.114.97.3 if feasible. Continuous re‑assessment is advised, as the presence of a valid certificate and CloudFlare routing may allow the operator to rapidly relocate the payload to alternative IPs while maintaining the same domain name.