safepals[.]gr[.]com

This domain, safepals.gr.com, poses a high-risk threat by impersonating SafePal, a legitimate hardware wallet provider. The site displays a page titled 'SafePal - 硬件钱包信息' (Hardware Wallet Information), likely designed to deceive users into entering sensitive wallet credentials or recovery phrases. Attackers may exploit this to gain unauthorized access to cryptocurrency wallets, leading to asset theft or irreversible financial loss. The threat specifically targets users familiar with SafePal’s branding, leveraging trust to facilitate fraudulent transactions or data exfiltration. Analysis indicates the domain is actively malicious, with 12 out of 95 security vendors on VirusTotal flagging it as harmful. It resolves to the IP address 191.44.114.185 and is registered through Key-Systems GmbH. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, further confirming its malicious intent. The SSL certificate, issued by Let’s Encrypt (R12), does not mitigate the risk, as attackers commonly use valid certificates to appear legitimate. Infrastructure review reveals no association with SafePal’s official domains or hosting providers. If you visited safepals.gr.com or interacted with its content, immediate action is required. Disconnect the device from the internet to prevent further data transmission. Do not enter any credentials, recovery phrases, or private keys. If you provided sensitive information, assume your wallet is compromised and transfer remaining assets to a new, secure wallet using a different device. Monitor all linked accounts for unauthorized transactions and report the incident to relevant security teams or blockchain analytics platforms. Reset passwords for any accounts accessed during the session and enable multi-factor authentication where possible. Users should also verify the authenticity of future communications by cross-referencing with SafePal’s official website or support channels.