mysafetro[.]com

Analysis of mysafetro.com, observed on July 25, 2026, indicates active infrastructure supporting a generic phishing campaign. The domain was registered on February 21, 2026 through OwnRegistrar, Inc. and resolves to the IPv4 address 51.255.149.48, which is routed within the OVH SAS network (AS16276) and geolocated to France. An SSL certificate issued by Let’s Encrypt (R12) is present, providing encryption but offering no assurance of legitimacy. HTTP requests return a 403 status code, suggesting intentional restriction of direct access while allowing indirect interactions.

The site is built on a WordPress stack, with MySQL, PHP, jQuery, and HTTP/3 detected, indicating a typical web‑application environment that can be leveraged for credential harvesting. Page metadata reports the title "Safetro," yet the actual page content has not been publicly disclosed, leaving the specific visual lures or credential‑capture mechanisms unconfirmed. VirusTotal records show that one of ninety‑three security scanners flags the domain, and the Gridinsoft trust score is recorded as 0 / 100, reinforcing the malicious classification. The domain appears on four external blocklists and is actively blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura, demonstrating that several threat‑intelligence feeds have already identified it as hostile.

Nameserver delegation uses ns1.cloudoon.com, ns2.cloudoon.net, and ns3.cloudoon.org, while an MX record with priority 0 points to mysafetro.com, a configuration often employed to support phishing‑related email spoofing. Given the confirmed hosting, certificate, and detection footprint, defenders should block the domain and its associated IP at perimeter defenses, monitor for outbound connections to the host, and update local threat feeds to include the observed blocklist identifiers.