safe[.]131731031[.]shop

The domain safe.131731031.shop was registered on September 13, 2025 through the registrar Spaceship, Inc. and is currently hosted on Cloudflare infrastructure, resolving to IP address 172.67.131.37, which belongs to AS13335 Cloudflare, Inc. in the United States. The domain is configured with Cloudflare authoritative nameservers athena.ns.cloudflare.com and mike.ns.cloudflare.com, but it does not present an SSL/TLS certificate, leaving the connection unencrypted. A single security vendor out of ninety‑five on VirusTotal flagged the domain, and it appears on one external blocklist, indicating that at least one detection source has identified malicious activity associated with the host. The site was classified as a brand impersonation campaign targeting Google, and the page title observed during the brief scan was "Ethena System - Professional iOS & Android App Development Services," which does not reference Google and suggests a possible content mismatch or placeholder page.

The Gridinsoft trust score for the domain is 0 out of 100, and the domain has been blocked by the PhishDestroy service. As of the report date, July 22, 2026, the domain is taken offline, which limits immediate threat exposure but does not preclude future re‑activation. Defenders should continue to monitor DNS resolutions for safe.131731031.shop, enforce blocklist entries that already reference the host, and consider adding the domain to internal deny‑list policies.

Additional verification of any inbound traffic to the associated IP address should be performed, especially if the IP is observed in other suspicious contexts. Organizations using Google services should remain vigilant for credential‑stealing attempts that may reference this domain, even though the current page content appears unrelated.