secsafe[.]xyz

The domain secsafe.xyz was registered on May 20, 2026 through OwnRegistrar, Inc. and is currently hosted on the IP address 104.21.24.166, which belongs to AS13335 Cloudflare, Inc. in the United States. DNS resolution points to the Cloudflare nameservers everton.ns.cloudflare.com and jo.ns.cloudflare.com, indicating the use of Cloudflare’s CDN and protection services. The site presented a valid Let's Encrypt certificate (issuer: YE1) at the time of observation, which does not preclude malicious use but confirms that TLS encryption was correctly configured. Infrastructure analysis shows a Gridinsoft trust score of 0 out of 100, signaling a highly untrusted reputation.

The domain appears on three independent security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the assessment of malicious intent. VirusTotal recorded a single positive detection out of 91 security vendors, confirming that at least one scanning engine identified the domain as suspicious. The overall risk rating was elevated, and the threat type was classified as generic phishing.

As of the report date, the domain has been taken offline, but historical indicators suggest it was used to host phishing content before removal. Defenders should continue to block any traffic to secsafe.xyz, monitor for re‑registration or use of the same IP range, and update web filtering policies to include the associated blocklist entries. Ongoing vigilance is advised, especially because the underlying Cloudflare infrastructure can be repurposed for future malicious campaigns.