ffcreditunion[.]com[.]ng[.]safepal[.]com[.]ng

This domain, ffcreditunion.com.ng.safepal.com.ng, was registered on February 21, 2026, and is assessed as a crypto scam impersonating SafePal, a cryptocurrency wallet provider. Infrastructure analysis reveals the domain resolved to 162.55.247.232, hosted on Hetzner Online GmbH infrastructure (AS24940) in Germany. The SSL certificate is classified as R13, and the page title was identified as 'Mortgage Savings Bank,' which does not align with SafePal’s branding, suggesting either misdirection or an attempt to obscure the site’s true purpose.

At the time of reporting, the domain is offline, though it was previously flagged by 12 of 93 security vendors on VirusTotal and appears on one security blocklist. Trust scores from Gridinsoft and Scamadviser are both 0/100 and 1/100, respectively, indicating high suspicion. Defenders should treat this domain as part of a broader crypto scam campaign targeting SafePal users.

While the domain is currently inactive, historical resolution data and detection metrics confirm its malicious intent. Network defenders are advised to block the domain and its associated IP, monitor for related subdomains or newly registered lookalike domains, and review logs for prior connections to 162.55.247.232. The exact phishing kit or payload is not confirmed in available data, but the combination of brand impersonation, low trust scores, and detection by multiple vendors supports classification as a high-risk crypto scam.