en-us-safepal[.]pages[.]dev

The domain en-us-safepal.pages.dev is currently engaged in brand impersonation, specifically targeting SafePal. This threat vector is categorized under brand impersonation, where malicious entities utilize this domain to deceive users by mimicking the SafePal brand. As of the latest analysis, this domain remains active and poses a potential risk of credential theft or other malicious activities under the guise of a legitimate brand.

The domain was created on May 27, 2026, and is registered through Cloudflare Pages. It has been flagged by PhishDestroy and is listed on one security blocklist, indicating some level of recognition of its risk. However, the domain has not yet been detected by any of the 95 security vendors indexed by VirusTotal, showing a 0/95 detection count. This lack of detection may allow the phishing campaign to operate undetected by many traditional security solutions, increasing the importance of proactive defensive measures.

Currently, en-us-safepal.pages.dev continues to be active, representing an ongoing threat. It is recommended that security teams continuously monitor this domain and consider implementing domain blocking measures to prevent potential exposure. Users should be advised to verify the legitimacy of SafePal-related communications and use multi-factor authentication where possible to mitigate the risks associated with brand impersonation. Additionally, reporting any suspicious activity related to this domain to appropriate security authorities will aid in the deterrence and mitigation of such threats.