safepall-io[.]pages[.]dev

Analysis indicates that the domain safepall-io.pages.dev was registered on 2026-05-01 through Cloudflare, Inc. and resolves to the Cloudflare‑owned address 172.66.47.176 located in Canada. The site serves HTTP 200 responses and presents a TLS certificate issued by Google Trust Services under the WE1 authority, which is typical for Cloudflare‑proxied services. The page title “SafePal Wallet Sign In – Access Your Digital Crypto Wallet” and the classification as brand_impersonation confirm that the page is intended to harvest credentials for the SafePal brand. The infrastructure is hosted on Cloudflare’s network, using the nameservers ada.ns.cloudflare.com and merlin.ns.cloudflare.com, and has been flagged by PhishDestroy and appears on one external blocklist. Gridinsoft assigns a trust score of 0/100, and VirusTotal reports detections by 2 of 91 security vendors. The risk level is high and the campaign remains active. Defenders should ensure that the domain is added to inbound and outbound web filtering rules, monitor DNS queries for the host, and educate users that any login prompt from this URL is fraudulent. Ongoing observation of the IP address and associated Cloudflare identifiers is recommended to detect any repurposing of the same infrastructure for future impersonation attempts.