safepal[.]guru

Analysis of the domain safepal.guru indicates active brand impersonation targeting SafePal, a cryptocurrency wallet provider. The domain was registered on March 7, 2026, and remains operational as of July 12, 2026, resolving to IP address 15.197.162.184. Infrastructure analysis reveals the use of XenForo forum software, MySQL, PHP, Nginx, and tracking technologies including Google Analytics and Yandex.Metrika, which are atypical for a legitimate wallet service but common in social engineering campaigns. The page title, 'Error - Social Engineering Forum — Lolz.live,' suggests an association with underground forums rather than an official SafePal portal. The domain is flagged by 2 security blocklists and appears in 23 threat intelligence pulses on AlienVault OTX, indicating prior malicious activity. A Let's Encrypt SSL certificate is present, which does not validate legitimacy due to its automated issuance. One security vendor on VirusTotal has detected the domain as malicious, though broader scanning coverage is limited. The domain was registered through Spaceship, Inc., a provider often used for disposable or low-reputation domains. No direct evidence confirms the exact nature of the scam (e.g., credential harvesting, crypto drainer, or fake support), as the site content has not been analyzed. However, the combination of brand impersonation, forum-based infrastructure, and threat intelligence flags strongly suggests malicious intent. Defenders should treat this domain as high-risk and block it at the network level. Further investigation into associated IP addresses and registration patterns is recommended to identify related threats.