safefire[.]jo

Analysis indicates that the domain safefire.jo is currently active and resolves to the IPv4 address 173.212.234.74, hosted by Contabo GmbH in France under AS51167. The authoritative nameservers are ns1.contabo.net, ns2.contabo.net, and ns3.contabo.net. The site delivers an HTTP 200 response and presents the page title “SafeFire – United Safety & Fire Fighting Systems Co. Ltd”. Certificate inspection shows a Let’s Encrypt issuance (E8). Backend fingerprinting reveals a WordPress stack with MySQL, PHP, Apache HTTP Server, and client‑side libraries Underscore.js, jQuery, and jQuery Migrate. VirusTotal reports eight detections out of ninety‑one scanners, and the domain appears in four AlienVault OTX pulses and one external blocklist. It is also listed by PhishDestroy and receives a Gridinsoft trust score of zero. Mail routing is directed to a Microsoft‑hosted Outlook protection service. While the page content has not been manually inspected, the convergence of phishing‑related detections, low trust score, and active hosting suggests a high‑confidence phishing operation targeting the United Safety & Fire Fighting Systems brand. Defenders should block the domain at perimeter firewalls and DNS filters, add the IP address 173.212.234.74 to network‑wide blocklists, monitor for outbound connections to the associated nameservers, and surveil email traffic for the listed MX host. Continuous threat‑intel updates are recommended to capture any further infrastructure changes.