# safe-pdf.net — SUSPICIOUS

> safe-pdf.net is a PDF-themed phishing site posing as a file-sharing service, flagged by 1/95 VirusTotal scanners.

## Summary
PhishDestroy identifies safe-pdf.net as an active phishing domain leveraging a PDF-themed lure to deceive users into downloading malicious files or submitting sensitive information. The domain mimics legitimate file-sharing services, exploiting user trust in PDF documents to deliver malware or harvest credentials. No specific drainer kit (e.g., crypto wallet drainers) has been detected in open-source intelligence, but the generic phishing tactic suggests opportunistic theft of login credentials or financial data.  

This domain was flagged by 1/95 security vendors on VirusTotal, indicating limited but notable detection. It was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, resolves to IP 188.114.97.3, and holds a valid Let’s Encrypt SSL certificate. The domain was created on March 17, 2026, and currently has no known presence on Google Safe Browsing (GSB) blocklists or major threat intelligence feeds as of the latest scan. The low VT detection ratio may reflect the site’s recent creation or evasion tactics, but the presence of a valid SSL certificate suggests an attempt to appear legitimate.  

As of the latest assessment, safe-pdf.net remains active and poses an elevated risk due to its PDF-themed phishing lure. Users should avoid interacting with this domain entirely, as it may lead to malware infections, credential theft, or financial loss. Immediate actions include blocking the domain at the network level (IP 188.114.97.3 and domain safe-pdf.net) and reporting it to local CERT teams or threat intelligence platforms. While the current risk is elevated, the domain’s recent creation and low detection rate suggest it may be part of a broader campaign—users should remain vigilant for similar lures. The remaining risk is mitigated by proactive blocking and user awareness, but the threat could escalate if the domain is weaponized further.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2026-03-17 17:29:21
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 188.114.97.3

## Detection Status
- VirusTotal: 1 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/85f7376b-6cd2-43cc-b608-6817733662f9
- PhishDestroy: https://phishdestroy.io/domain/safe-pdf.net/
- LLM endpoint: https://phishdestroy.io/domain/safe-pdf.net/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/safe-pdf.net/
Last updated: 2026-03-23