safe-markt[.]cc

safe-markt.cc was observed on July 24, 2026 as an offline domain that had been employed in a generic phishing campaign. The site presented the page title “≥ PS4 met 2 controllers en 10 games — Marktplaats”, indicating an attempt to lure victims with a Marktplaats‑related listing. The domain was registered on 21 February 2026 through Dynadot LLC and resolves to the IP address 172.67.151.87, which is owned by Cloudflare, Inc. (AS13335) and is geolocated to the United States. No SSL certificate was detected, meaning the site was delivered without HTTPS.

Authoritative nameservers are ns1.dyna‑ns.net and ns2.dyna‑ns.net. The domain appears on a single public blocklist, PhishDestroy, and VirusTotal recorded six positive detections out of ninety‑three scanned scanners. These indicators collectively suggest that the domain was actively used for phishing before being taken offline. The current offline status limits further technical observation, and the limited blocklist presence leaves the full scope of the campaign uncertain.

Defenders should continue to monitor the associated IP address and Cloudflare ASN for any re‑use, enforce blocklisting of the domain and its IP in perimeter defenses, and consider adding the nameservers to watch lists for future registrations. Because the page title references Marktplaats, organizations that rely on that marketplace should advise users to verify URLs and avoid entering credentials on untrusted sites. Ongoing collection of any renewed activity will be required to assess whether the infrastructure is repurposed.