safeid[.]com[.]ng[.]safeguard[.]org[.]ng

This domain, www.safeid.com.ng.safeguard.org.ng, is currently active and classified as a generic phishing threat with a high-risk designation. Analysis indicates it impersonates a corporate login portal, as evidenced by the page title 'Sign In | Your Company,' suggesting an attempt to harvest employee or organizational credentials. The domain is designed to mimic legitimate authentication interfaces, increasing the likelihood of successful social engineering attacks against unsuspecting users. Infrastructure analysis reveals the domain was registered on September 18, 2024, through the registrar Leads Globe. It resolves to the IP address 163.61.188.7 and is flagged by 1 of 95 security vendors on VirusTotal, indicating limited but present detection. The domain appears on one security blocklist and holds a Gridinsoft trust score of 0/100, reflecting negligible legitimacy. The SSL certificate is issued by Let's Encrypt, a common tactic among phishing domains to appear secure while lacking organizational validation. Additional technical indicators include its recent creation date and the use of subdomains to obfuscate its true purpose. The domain remains active as of the latest assessment, posing an ongoing risk to users who may interact with it. Organizations and individuals are advised to block the domain and its associated IP address at the network level. Security teams should monitor for credential submission attempts originating from this infrastructure and educate users on identifying cloned login pages. Given the domain's recent registration and low detection rate, proactive threat hunting is recommended to identify potential compromise indicators, such as unusual authentication attempts or network connections to 163.61.188.7. Immediate reporting to relevant security platforms is encouraged to enhance collective defense.