ap-sefpal-us-io[.]pages[.]dev

This domain, ap-sefpal-us-io.pages.dev, is actively engaged in brand impersonation targeting SafePal, a cryptocurrency wallet provider. The site presents itself as a legitimate SafePal Wallet platform, offering services such as storing, sending, and receiving cryptocurrency. Analysis indicates this is a high-risk threat designed to deceive users into disclosing sensitive credentials or transferring digital assets to attacker-controlled addresses. Infrastructure analysis reveals the domain was created on May 06, 2026, and is registered through Cloudflare Pages. It resolves to the IP address 188.114.96.3, located in Canada and associated with Cloudflare, Inc. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious sites leveraging Cloudflare’s infrastructure. Security telemetry shows the domain is flagged by 1 of 95 vendors on VirusTotal and appears on one security blocklist, specifically PhishDestroy. The page title, 'SafePal Wallet – Store, Send & Receive Cryptocurrency Safely,' directly mimics the branding and messaging of the authentic SafePal platform. Current status confirms the domain remains active and accessible. Users are advised to treat this domain as malicious and avoid interaction. Organizations should update blocklists to include ap-sefpal-us-io.pages.dev and its resolving IP address. Cryptocurrency users should verify the authenticity of wallet services by accessing only the official SafePal domain and enabling multi-factor authentication. Security teams are recommended to monitor for additional domains using similar naming conventions (e.g., 'sefpal,' 'safepal-us') and assess network logs for connections to 188.114.96.3.