safepal-hub[.]cc

On July 22, 2026 the domain safepal-hub.cc was observed offline but retains indicators of a Google‑impersonation campaign. The domain was registered on March 11, 2026 through the registrar Spaceship, Inc. and resolves to the Cloudflare address 172.67.149.229, which belongs to ASN 13335 (Cloudflare, Inc.) located in the United States. The authoritative nameservers are devin.ns.cloudflare.com and margaret.ns.cloudflare.com, confirming Cloudflare hosting. TLS termination is performed with a certificate issued by Google Trust Services / WE1, which may be intended to lend credibility to the fraud site.

The page title returned from the now‑inactive site reads “SafePal Browser Extension - Instal: Educational Resource | SafePal Extension Info”, suggesting an attempt to masquerade as a SafePal extension while targeting Google users. The campaign is classified as a Tech Support Scam and received a Gridinsoft trust score of 0 / 100, indicating a high confidence of malicious intent. Threat intelligence aggregators have flagged the domain: it appears on three security blocklists, is listed in one AlienVault OTX pulse, and is blocked by PhishDestroy, MetaMask, and SEAL.

VirusTotal analysis shows that 3 of 94 scanning engines flagged the domain, reinforcing the suspicion. Given the combination of a Google‑related SSL certificate, the deceptive page title, and the low trust score, defenders should continue to block safepal-hub.cc at the DNS and proxy layers, monitor for any re‑hosting attempts, and incorporate the domain and its IP address into existing threat‑intel feeds. Continuous observation of the associated Cloudflare IP range for new malicious subdomains is also recommended.