# safepal.pages.dev — SUSPICIOUS

> PhishDestroy identifies safepal.pages.dev as an active brand-impersonation site impersonating SafePal.

## Summary
PhishDestroy identifies safepal.pages.dev as an active brand-impersonation domain falsely mimicking SafePal to deploy a wallet drainer kit. The site registered via Cloudflare, Inc., resolves to IP 188.114.96.3, and holds a Google Trust Services SSL certificate.

This domain was flagged with a VirusTotal score of 1/95, and appears on 2 security blocklists. Creation details remain unverified; however, active SSL issuance and resolver data confirm recent deployment.

Current status: domain active and blocked by Enkrypt and ScamSniffer. Users should avoid interaction and report any transactions to SafePal support. Remaining risk: elevated due to ongoing accessibility via Cloudflare Workers.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)
- Target brand: SafePal

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 188.114.96.3

## Detection Status
- VirusTotal: 1 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 2 hits
  Lists: ["Enkrypt", "ScamSniffer"]

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/7032b82f-06e3-47d7-8bf3-590791752f61
- PhishDestroy: https://phishdestroy.io/domain/safepal.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/safepal.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/safepal.pages.dev/
Last updated: 2026-03-21