coredomax[.]com

This domain, www.coredomax.com, is confirmed as an active brand impersonation phishing site designed to deceive users of the SafePal cryptocurrency wallet service. Analysis indicates the site mimics SafePal’s official branding, including the use of the identical page title 'SafePal,' to trick victims into disclosing sensitive credentials or transferring digital assets. The threat type is classified as elevated due to its targeted nature and potential for financial harm, particularly in the cryptocurrency sector where irreversible transactions are common. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification. The domain was registered on April 12, 2026, through NameSilo, LLC, a registrar frequently associated with phishing and fraudulent domains. It resolves to the IP address 43.154.130.83, which has been linked to other suspicious activities in recent threat intelligence reports. Detection metrics show limited but concerning coverage, with 2 out of 95 security vendors on VirusTotal flagging the domain as malicious. The domain appears on one security blocklist and is assigned a trust score of 0/100 by Gridinsoft, further corroborating its fraudulent intent. Technologies detected on the site include Vue.js, Nginx, Marked, HSTS, and HTTP/3, which are consistent with modern phishing kits designed to evade detection and enhance credibility. Mitigation steps for organizations and end-users include immediate blocking of the domain and its associated IP address, 43.154.130.83, at the network perimeter. Users who may have interacted with the site should revoke any active sessions, reset credentials for SafePal and associated accounts, and monitor for unauthorized transactions. Cryptocurrency wallet holders are advised to verify the authenticity of any communication or website claiming to represent SafePal by cross-referencing with official channels. Security teams should update detection rules to include the domain, IP, and registrar details in threat intelligence feeds to prevent further exposure. Given the elevated risk, proactive monitoring for similar impersonation attempts targeting cryptocurrency services is recommended.