safepal-download[.]at

The domain safepal-download.at has been identified as a brand impersonation phishing site specifically targeting SafePal, a popular cryptocurrency wallet. Currently offline, this domain was designed to deceive users into downloading malicious software or revealing sensitive information under the guise of a legitimate SafePal service. The threat is elevated due to its precise imitation of SafePal's branding and its presence on security blocklists.

Technical analysis reveals several red flags. The domain was created on March 28, 2026, and resolves to IP address 188.114.96.3, hosted behind Cloudflare. Its SSL certificate is issued by Google Trust Services (WE1), which lends a false sense of legitimacy. VirusTotal flags it with 4 out of 95 vendors marking it malicious, and it appears on at least one security blocklist. The page title, "SafePal钱包 - 安全的Web3加密钱包下载 2026" (translated as "SafePal Wallet - Secure Web3 Crypto Wallet Download 2026"), further confirms the impersonation. Additionally, AlienVault OTX includes it in one threat intelligence pulse, indicating community awareness.

Given that the domain is now offline, the immediate risk is reduced, but users should remain vigilant. PhishDestroy recommends that anyone who may have visited this domain avoid entering any personal or financial information and ensure their devices are scanned for malware. Users should always verify official SafePal download sources through the company's verified website or app stores. This incident underscores the importance of checking domain details and using reliable security tools before interacting with cryptocurrency-related sites.