safe-pdf[.]net

This domain, safe-pdf.net, is flagged as a generic phishing site targeting users through a fraudulent file verification interface labeled 'CheckVault — Загрузка.' Analysis indicates the site is designed to harvest login credentials or personal data under the guise of document processing. No specific brand impersonation or drainer kit signatures were identified, but the page title and language suggest targeting Russian-speaking users or entities handling document workflows. Infrastructure analysis reveals the domain was registered on March 17, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolves to the IP address 188.114.97.3. Security vendor detections on VirusTotal stand at 6/95, with Gridinsoft assigning a trust score of 0/100. The domain appears on one security blocklist and is currently blocked by PhishDestroy. Technical indicators include the use of PHP, Cloudflare Browser Insights, Cloudflare CDN, and HTTP/3 protocol, alongside a Let's Encrypt SSL certificate to encrypt traffic and evade basic scrutiny. As of the latest assessment, safe-pdf.net has been taken offline, reducing immediate exposure risk. However, the domain's infrastructure remains registered and could be reactivated or repurposed. Organizations should monitor for related indicators, including the resolving IP 188.114.97.3 and registrar patterns associated with NICENIC INTERNATIONAL GROUP CO., LIMITED. Users who interacted with the domain prior to takedown should assume credential compromise and initiate password resets, particularly for accounts linked to document or file-sharing services. Network-level blocking of the domain and IP is recommended as a precautionary measure.