safe-safepalwalle[.]pages[.]dev

Analysis of safe-safepalwalle.pages.dev indicates active brand impersonation targeting cryptocurrency users, specifically mimicking SafePal Wallet as suggested by the page title 'SafePal Wallet – Securely Manage Your Crypto Assets.' The domain was registered on September 10, 2025, through Cloudflare, Inc., and remains active as of July 12, 2026. Infrastructure analysis reveals the site is hosted behind Cloudflare (AS13335) with an IPv6 address of 2a06:98c1:3121::3 and uses standard security headers including HSTS and HTTP/3. The SSL certificate is issued by Google Trust Services (WE1), a common configuration for legitimate and malicious sites alike. The domain is flagged on one security blocklist and identified as distributing a seed phrase phishing kit, a common tactic in cryptocurrency scams. Gridinsoft assigns a trust score of 0/100, while Scamadviser rates it 41/100, both indicating low confidence. The domain appears to impersonate Aave, a decentralized finance protocol, though the page title suggests a focus on SafePal Wallet users. No malicious detections were reported by 93 vendors in a recent scan, but this absence does not confirm safety. Defenders should treat this domain as high-risk for credential and seed phrase theft. The use of Cloudflare infrastructure and a valid SSL certificate does not mitigate the threat, as these are frequently leveraged by malicious actors to evade detection. Given the domain's recent registration, active status, and association with a known phishing kit, organizations should consider blocking access and monitoring for related indicators in logs. Further investigation into user interactions with this domain is recommended to assess potential compromise.