webdisk[.]multisafeprotocol[.]xyz

PhishDestroy has identified webdisk.multisafeprotocol.xyz as a generic phishing domain with an elevated risk level. The domain is currently offline, but its purpose was likely to deceive users into divulging sensitive information, such as credentials or personal data, through a fraudulent login page. The page title was observed as "Nur einen Moment…" which translates to "Just a moment…" in German, a tactic commonly used to mimic loading screens and lull victims into complacency.

Technical indicators paint a clear picture of the domain's malicious nature. VirusTotal flagged the domain with 1 out of 95 security vendors detecting it as malicious, and it appears on one security blocklist. The domain was registered through OwnRegistrar, Inc. on September 12, 2025, a very recent date that aligns with typical phishing domain lifespans. It resolved to IP address 104.21.16.1, which is associated with Cloudflare, a service often abused by phishers to hide their true hosting locations. Notably, the domain had no SSL certificate, an omission that is unusual for legitimate sites but common among phishing operations.

Given that the domain is already offline, users who may have encountered it should take immediate protective steps. If any credentials were entered on the site, they should be changed immediately on the legitimate platforms they correspond to, and two-factor authentication should be enabled wherever possible. PhishDestroy recommends running a full security scan on any device that accessed the domain, as generic phishing pages sometimes deploy malware or steal session cookies. Always verify URLs before entering sensitive information, and rely on trusted sources like PhishDestroy for up-to-date threat intelligence.