cpanel[.]multisafeprotocol[.]xyz

Analysis indicates that cpanel.multisafeprotocol.xyz was registered on September 12, 2025 through OwnRegistrar, Inc. The domain resolves to the IPv6 address 2606:4700:3030::6815:5001, which is announced by AS13335 Cloudflare, Inc. and geolocated to the United States. Cloudflare nameservers gracie.ns.cloudflare.com and patrick.ns.cloudflare.com are configured for the zone. A TLS handshake was not presented; the site lacks an SSL certificate, which is typical for quickly deployed phishing infrastructure. The only observed page element is the HTML title “Un momento…”, suggesting a language‑specific landing page but providing no further context.

Scamadviser assigns a trust score of 35 / 100, while Gridinsoft rates the domain at 0 / 100, reflecting a high likelihood of malicious use. The domain appears on a single public blocklist and has been flagged by PhishDestroy as taken offline. VirusTotal reports that 7 of 95 scanning engines have identified the domain as malicious, reinforcing the suspicion. Given the limited public footprint, the precise phishing campaign cannot be confirmed.

However, the combination of a recent registration, low trust scores, blocklist presence, and multiple vendor detections qualifies the site as an elevated‑risk phishing artifact. Defenders should add the domain and its associated IPv6 address to inbound and outbound filtering rules, monitor Cloudflare name‑server activity for any re‑use, and continue to harvest any future resolutions that may point to new hosting. Ongoing threat‑intel feeds should be consulted for any emerging indicators that tie the domain to broader campaigns.