safepal-live[.]com

This domain, safepal-live.com, is currently offline but was actively blocked by PhishDestroy. The domain resolves to the IP address 172.67.151.90, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. Registration data shows the domain was created on July 15, 2025 and was registered through HOSTINGER operations, UAB. The authoritative nameservers are alec.ns.cloudflare.com and dawn.ns.cloudflare.com, and no TLS certificate is present, indicating the site was served over plain HTTP when it was reachable.

The single page that was observed returned the title “1 new message,” and the domain is listed on one security blocklist. Threat intelligence classifies the site as a wallet/seed phishing operation that impersonates the Curve brand. VirusTotal analysis recorded three detections out of ninety‑five scanned vendors, confirming that multiple security products consider the domain malicious. The combination of a recent registration date, Cloudflare hosting, lack of SSL, and the observed page title aligns with typical infrastructure used for credential‑stealing kits targeting cryptocurrency wallets.

Defenders should ensure that DNS resolvers block safepal-live.com and its associated IP address, add the domain to local blocklists, and monitor for any future re‑registration attempts. Network traffic to 172.67.151.90 should be inspected for anomalous HTTP requests that could indicate a resurgence of the phishing kit. Because the domain was taken down, any ongoing campaigns are likely dormant, but threat‑intel feeds should be updated to reflect the observed indicators of compromise.