safepa[.]top

The domain safepa.top has been identified as a high-risk threat, actively impersonating a well-known brand associated with decentralized financial services. The page title associated with this domain reads "CME Group: A decentralized trading platform with low fees and high liquidity," suggesting an intent to mislead users into thinking they are engaging with a legitimate service. This impersonation can potentially lead to unauthorized access to sensitive user information. The domain was created on June 16, 2026, and is currently registered through Dynadot LLC.

Analysis indicates that this domain has been flagged by four distinct security blocklists, including SEAL, MetaMask, PhishDestroy, and BLP-Malware. Furthermore, it has a very low trust score of 0 out of 100 on Gridinsoft, underscoring its malicious intent. Virustotal results show that 14 out of 95 security vendors have flagged this domain, corroborating its association with phishing and other fraudulent activities. The domain resolves to the IP address 104.21.63.192, which could be part of a broader malicious infrastructure.

Additionally, threat intelligence sources such as AlienVault OTX indicate that this domain has been noted in 14 separate threat intelligence pulses, further validating its active role in phishing campaigns. The technology stack utilized by this domain includes Vue.js, Cloudflare Browser Insights, and Cloudflare, which are commonly employed to enhance the site's performance and to obscure its true nature from security scrutiny.

Defenders should prioritize monitoring for any interactions with this domain, especially among users who may inadvertently attempt to access it. Increased user education on identifying legitimate services and potential phishing threats is also recommended. Given the active status of safepa.top and its identified threats, immediate actions should be taken to block and report this domain across multiple security platforms.