safepal[.]com[.]ag

On July 29, 2026 the domain safepal.com.ag was identified as an active generic phishing infrastructure with a high risk rating. Registration records show the domain was created through Hosting Concepts B.V. d/b/a Registrar.eu, indicating a commercial registrar that is frequently used by malicious actors. The authoritative name servers are ns1.openprovider.nl, ns2.openprovider.be, and ns3.openprovider.eu, all belonging to the OpenProvider hosting platform, a known provider for disposable or rapidly‑re‑configured services.

The domain currently appears on three security blocklists, and it has been explicitly blocked by the PhishDestroy, MetaMask, and SEAL threat‑intelligence feeds, confirming its association with phishing campaigns targeting cryptocurrency wallets and related user credentials. VirusTotal analysis shows that 19 of 91 scanned security vendors flagged the domain as malicious, providing independent corroboration of its illicit intent. No additional technical artifacts such as IP address, SSL certificate details, or HTTP response codes are available in the current intelligence set, leaving the broader hosting environment unverified.

Analysts should prioritize immediate containment: add safepal.com.ag to network‑level deny lists, update DNS filtering policies to block resolution of its name servers, and monitor for any derivative domains registered through the same registrar or using the same OpenProvider name server pattern. Ongoing surveillance of the three blocklists and the three blocking feeds is recommended to capture any changes in the domain’s status or detection confidence.