en-safepal[.]org

Analysis performed on en-safepal.org as of July 25, 2026 indicates the domain is being used for a wallet/seed phishing campaign that pretends to be associated with the Aave brand. The site’s HTML title reads “Safepal Wallet — Secure Crypto Hardware & Software App,” which aligns with the declared scam type. The domain was registered on February 21, 2026 and is serviced by Cloudflare, Inc., with the authoritative DNS resolving to the IP address 172.67.163.196, an address belonging to AS13335 Cloudflare located in the United States. The SSL certificate presented is identified as “WE1,” confirming the presence of HTTPS but offering no additional trust signals.

Reputation data shows the domain appears on a single security blocklist and has received a Gridinsoft trust score of 0 out of 100, reflecting a low confidence rating. PhishDestroy has explicitly blocked the domain, and VirusTotal records indicate that six of ninety‑three scanning engines flagged the host as malicious. The combination of a recent creation date, low trust score, blocklist presence, and multiple vendor detections suggests an elevated risk level despite the current offline status.

Defenders should continue to block any traffic to en‑safepal.org at network perimeter devices, update URL filtering rules, and monitor for related indicators such as the associated IP address and SSL fingerprint. Incident response teams handling Aave‑related credential compromise should consider this domain as a potential source of phishing artifacts and incorporate its indicators into threat‑intel feeds. Ongoing observation of Cloudflare‑hosted infrastructure is advised, as attackers frequently leverage the platform to spin up new phishing sites after takedown.