safedus[.]net

Analysis of safedus.net as of July 19, 2026, indicates active credential-phishing infrastructure. The domain resolves to 163.61.188.7 (US-based hosting, MIT) and is served by four nameservers under lytehosting.com. A valid Let's Encrypt SSL certificate (YR2) is present, and the site returns HTTP 200, suggesting operational status. The page title 'Safedus' does not correspond to a known legitimate brand, and no specific brand impersonation or scam category is confirmed in available data. Infrastructure review shows registration through TuringSign Inc. d/b/a Cosmotown, a registrar frequently associated with abusive domains. AlienVault OTX lists safedus.net in two threat intelligence pulses, and six of 91 security vendors on VirusTotal flag the domain. PhishDestroy currently blocks it, and the domain appears on one additional security blocklist. No phishing kit or targeted brand is identified in the provided indicators. Defenders should treat safedus.net as high-risk. Recommended actions include blocking the domain and IP at perimeter controls, monitoring for connections to 163.61.188.7, and alerting users to potential credential-harvesting attempts. Further analysis of site content is required to determine exact phishing mechanics or targeted entities.