h5[.]dappvip[.]cc

The domain h5.dappvip.cc is identified as a brand_impersonation threat specifically targeting SafePal, a cryptocurrency wallet provider. Analysis confirms the domain was designed to mimic SafePal’s official interfaces, likely to deceive users into disclosing sensitive credentials or transferring assets to attacker-controlled addresses. Currently, the domain is offline, but prior activity raises significant concerns about its intent and infrastructure. Infrastructure analysis reveals multiple high-risk indicators. The domain was created on March 9, 2026, and resolved to the IP address 104.21.72.51. It is flagged by 8 of 95 security vendors on VirusTotal, and appears on three distinct security blocklists. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as fraudulent domains commonly leverage valid certificates to appear legitimate. The domain was registered through Gname.com Pte. Ltd., a registrar frequently associated with high-risk or malicious registrations. Given the domain’s current offline status, immediate user interaction risks are reduced. However, the technical indicators—including the creation date discrepancy, blocklist presence, and vendor detections—strongly suggest malicious intent. Users are advised to verify all interactions with SafePal through official channels only. Security teams should monitor for re-registration or similar domains, particularly those resolving to the same IP or using identical SSL issuers. Proactive blocklisting of the domain and its associated infrastructure is recommended to prevent future exposure.