safeguild[.]pro

Analysis of the domain safeguild.pro, first observed on February 21, 2026, indicates an active malicious infrastructure consistent with a generic phishing operation. The web server returns HTTP 403 responses and displays the page title “Nur einen Moment…”, a phrase frequently employed by phishing sites to pause user interaction. The domain is hosted behind Cloudflare, using the nameservers trevor.ns.cloudflare.com and jillian.ns.cloudflare.com, and resolves to IP 172.67.187.122, which belongs to AS13335 Cloudflare, Inc., located in the United States. TLS termination is provided by a Google Trust Services / WE1 certificate, showing the use of a legitimate certificate authority to increase perceived trust.

VirusTotal scans report that 2 of 93 security vendors have flagged the domain, and it appears on one external blocklist. The site is also listed by PhishDestroy and receives a Gridinsoft trust score of 0 / 100, both of which reinforce a high confidence of malicious intent. Registration was performed through NiceNIC International Group Co., Limited, a registrar that has been linked to abusive registrations in prior threat intel. No further details such as specific credential‑stealing pages, targeted brands, or payload characteristics are currently available, leaving the exact phishing lure uncertain.

Nevertheless, the combination of a recent registration date, Cloudflare front‑end, a legitimate SSL certificate, low vendor detection count, and blocklist listings suggests a deliberate attempt to evade detection while presenting a convincing TLS badge. Defenders should block safeguild.pro at DNS or firewall level, add the IP address 172.67.187.122 to deny‑list rules, and monitor outbound traffic for attempts to resolve the domain. End‑user awareness messages should warn that any login prompt associated with the “Nur einen Moment…” title is likely fraudulent.