dashboard-safe[.]xyz

The domain dashboard-safe.xyz was registered through Dynadot LLC on 13 March 2026 and remains active as of 12 July 2026. Its authoritative name servers are troy.ns.cloudflare.com and vida.ns.cloudflare.com, pointing to the Cloudflare network (ASN 13335). Geolocation places the sole A record at 104.21.35.188, an address owned by Cloudflare, Inc. The domain resolves to the United States, consistent with the hosting provider’s footprint.

Web‑service inspection shows the site presents a TLS certificate issued by Let’s Encrypt (tier E7) and negotiates HTTP/3 over Cloudflare’s edge. The HTTP response currently returns status code 403, while the page title reports a “504: Gateway time‑out” condition. These mixed signals suggest that the front‑end is intentionally restricted, possibly to mask malicious payload delivery behind legitimate Cloudflare services.

Threat intelligence flags the domain as a high‑risk generic phishing campaign employing a streaming‑service lure. It appears on three public blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL. The Gridinsoft trust score is 0 out of 100, indicating a strong malicious reputation. VirusTotal analysis shows that 1 of 95 security vendors flagged the domain, reinforcing the suspicion despite limited vendor coverage. The convergence of a zero trust score, blocklist presence, and targeted blocking aligns with a credential‑harvesting operation that mimics streaming platforms.

Defenders should add dashboard-safe.xyz to network‑level deny lists and enforce DNS sink‑hole redirection for any resolution attempts. Monitoring for outbound connections to the 104.21.35.188 address can reveal compromised hosts. Because the domain leverages Cloudflare’s CDN, standard URL‑filtering may be bypassed; inspection of TLS Server Name Indication (SNI) and HTTP/3 headers is advisable. Continuous re‑evaluation of VirusTotal and blocklist reports is recommended to capture any escalation in vendor detection.