safergf[.]pages[.]dev

The domain safergf.pages.dev is currently engaged in a brand impersonation phishing campaign specifically targeting Ethereum users. This domain, which remains active as of the latest analysis, is designed to mimic the legitimate Safe{Core} modular Ethereum smart account infrastructure, tricking visitors into believing they are on an official Ethereum-related platform. The threat level is assessed as high, given the domain's sophisticated disguise and its presence on three security blocklists.

Technical indicators reveal that safergf.pages.dev was registered on April 1, 2026, through Cloudflare, Inc., and is hosted on IP address 188.114.97.3, which is associated with Cloudflare's infrastructure. The SSL certificate is issued by Google Trust Services / WE1, lending a false sense of legitimacy. Notably, 5 out of 95 security vendors on VirusTotal flag this domain as malicious, and it appears on three distinct security blocklists, further corroborating its dangerous nature. The page title explicitly references "Safe{Core}" and "Modular Ethereum Smart Account Infrastructure," which are trademarks of the legitimate Safe project, indicating a targeted impersonation.

Given that this domain is still active and has a high risk level, users are strongly advised to avoid interacting with safergf.pages.dev in any way. PhishDestroy recommends not clicking any links or entering any personal information on this website. If you have already visited the site or entered credentials, change your passwords immediately and enable two-factor authentication on your accounts. Always verify URLs by checking the official Safe website or Ethereum resources before engaging with any platform claiming to represent these brands.