multisafeprotocol[.]xyz

Analysis indicates that the domain multisafeprotocol.xyz was registered on September 12, 2025 through OwnRegistrar, Inc. The domain is currently taken offline, but historical records show it resolved to the Cloudflare front‑end IP address 104.21.32.1, which belongs to ASN 13335 (Cloudflare, Inc.) and is geolocated in the United States. The authoritative name servers are gracie.ns.cloudflare.com and patrick.ns.cloudflare.com, confirming that the domain leveraged Cloudflare’s DNS and CDN services. No TLS certificate was observed for the site, meaning HTTPS was not offered at the time of capture. Content‑level evidence consists solely of the page title “Nur einen Moment…”, which does not reveal a target brand or service, and thus the site is classified as a generic phishing vector based on the supplied threat type.

The domain appears on one external security blocklist and is listed as blocked by the PhishDestroy service. Reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, reinforcing its malicious nature. VirusTotal scans reported that seven out of ninety‑five security vendors flagged the domain, providing additional corroboration of malicious intent. Uncertainty remains regarding the exact phishing payload or credential‑stealing mechanisms, as no page content, HTTP response codes, or malware samples have been disclosed.

Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the hostname, and consider adding the IP address 104.21.32.1 to network‑level deny lists, recognizing that the address is shared among many legitimate Cloudflare customers. Ongoing surveillance of the registrar and associated name servers is advisable, as future re‑registrations could reuse the same infrastructure. Organizations employing threat‑intel feeds should ensure that the indicator multisafeprotocol.