safepal-extension[.]cc

The domain safepal-extension.cc is identified as a high-risk brand impersonation site specifically targeting SafePal, a cryptocurrency wallet provider. Analysis indicates the domain was designed to mimic legitimate SafePal support pages, likely to facilitate crypto wallet drainer attacks or credential harvesting under the guise of wallet recovery assistance. The current status of the domain is offline, though prior activity and infrastructure remain under scrutiny. Infrastructure analysis reveals multiple high-risk indicators. The domain was flagged by 11 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100, indicating no legitimate reputation. It appears on three security blocklists and is actively blocked by MetaMask, SEAL, and PhishDestroy. The domain was registered on February 21, 2026, through Spaceship, Inc., and resolved to the IP address 188.114.96.3. The page title, 'SafePal Extension - Wallet Recovery Guide & Support,' further confirms the intent to deceive users seeking legitimate wallet recovery or extension support. Current status confirms the domain has been taken offline, though residual risk persists due to the infrastructure's prior use. Organizations and end-users are advised to treat any prior engagement with this domain as compromised. Immediate actions should include revoking access to any associated wallet extensions, rotating credentials, and monitoring for unauthorized transactions. Network-level blocking of the domain and its resolved IP is recommended to prevent accidental re-exposure. Users who interacted with this domain should assume their wallet recovery phrases or private keys may have been exposed and take appropriate remediation steps, including migrating assets to new, secure wallets.