my-safepal[.]at

This domain, my-safepal.at, is flagged as a high-risk brand impersonation targeting SafePal, a cryptocurrency wallet provider. Analysis indicates the domain was designed to mimic legitimate SafePal services, likely to deceive users into disclosing sensitive credentials or interacting with malicious smart contracts. No direct evidence of a crypto drainer kit was observed, but the domain’s structure and timing align with known impersonation campaigns targeting crypto asset holders. The page title 'Welcome' suggests a generic landing page, potentially serving as a gateway to more sophisticated credential harvesting or wallet-drainage mechanisms. Infrastructure analysis reveals the domain was registered through Hosting Concepts B.V. (Registrar.eu) and resolved to the IP address 188.114.96.3. VirusTotal detection metrics show 15 out of 95 security vendors flagging the domain as malicious, while it appears on three distinct security blocklists. The domain’s Gridinsoft trust score is 0/100, reinforcing its high-risk classification. AlienVault OTX records indicate the domain was included in two threat intelligence pulses, further corroborating its association with malicious activity. No Google Safe Browsing (GSB) status was provided, but the domain’s offline status suggests mitigation efforts may have been successful. The domain is currently offline, reducing immediate exposure risk. However, residual threats persist due to its prior inclusion in threat intelligence feeds and blocklists. Organizations should monitor for re-registration attempts or shifts in hosting infrastructure. Users who interacted with the domain are advised to revoke any connected wallet permissions, rotate credentials, and scan for unauthorized transactions. Security teams should update blocklists to include the domain and associated IP, while remaining vigilant for similar impersonation attempts targeting crypto-related services.