safepaldappschain[.]cloud

Analysis of safepaldappschain.cloud shows it was registered on March 14 2025 through Web Commerce Communications Limited and currently resolves to 104.21.53.78, an address owned by Cloudflare (AS13335) located in the United States. The site presents the page title Just a moment..., lacks an SSL certificate, and is classified as a crypto-scam that impersonates the SafePal brand. Threat intelligence indicates the domain appears on a single security blocklist and has been flagged by one of ninety-five vendors on VirusTotal, confirming malicious intent despite the low overall detection count.

PhishDestroy has taken the domain offline, and the domain’s authoritative name servers are alina.ns.cloudflare.com and clint.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. While the limited blocklist presence suggests modest visibility, the combination of brand impersonation, crypto-scam labeling, and the observed vendor detection warrants elevated risk assessment.

Defenders should immediately add safepaldappschain.cloud to web-filter deny lists, monitor traffic to its hosting IP for any residual connections, and enforce TLS inspection policies to detect attempts to reach the domain without a certificate. Ongoing surveillance of newly registered domains using the same registrar or similar naming patterns is recommended, as well as periodic re-scanning on VirusTotal to capture any change in detection posture.