safews[.]xyz

The domain safews.xyz was registered on 08 June 2026 through GMO Internet, Inc. and is currently resolved to the Cloudflare‑hosted address 188.114.97.3. Its authoritative name servers are alfred.ns.cloudflare.com and autumn.ns.cloudflare.com, indicating use of Cloudflare’s DNS infrastructure. VirusTotal records show that one of ninety‑one scanned security vendors flagged the domain, confirming the presence of malicious activity. The threat classification is generic_phishing and the risk rating is high; the domain remains active as of 14 July 2026. Analysis indicates that the short registration window and reliance on Cloudflare’s edge services are consistent with typical phishing infrastructure designed to hide origin and provide resiliency. The single vendor detection suggests that the payload or lure may be newly observed, limiting broader detection coverage. No additional intelligence such as associated IP ranges, ASN, or observed victim reports is available at this time. Defenders should treat safews.xyz as a high‑confidence phishing indicator. Recommended actions include adding the domain to blocklists at network perimeter and DNS filtering points, monitoring for any DNS queries to the IP address 188.114.97.3, and correlating internal logs for traffic to the domain. Given the active status, continued observation for changes in resolution or additional detections is advised.