api[.]safe-coin[.]co

This domain, api.safe-coin.co, is currently listed as active in a generic phishing operation. The domain was blocked by the PhishDestroy service and appears on a single security blocklist, indicating that at least one reputable sinkhole has taken mitigation action. VirusTotal analysis shows that one out of ninety‑one scanned scanners returned a positive result, which confirms the presence of malicious indicators despite the low overall detection ratio.

No additional public intelligence such as registrar details, registration date, IP address, hosting provider, SSL certificate information, HTTP response codes, or Safe Browsing verdicts has been disclosed in the available feed. Consequently, the full infrastructure supporting the domain cannot be fully mapped at this time. Defenders should treat the domain as hostile and enforce network‑level blocking, add it to internal URL filtering lists, and monitor for any related C2 traffic or credential‑harvesting activity.

Continuous re‑evaluation is advised, as further analysis may reveal hosting patterns or additional phishing payloads. Until more concrete evidence emerges, the recommended mitigation posture remains elevated due to the confirmed phishing classification and the presence of at least one vendor detection.