wallet[.]s1-safepal[.]co[.]com

PhishDestroy identifies an active brand-impersonation campaign targeting SafePal cryptocurrency wallet users via the domain wallet.s1-safepal.co.com. This malicious domain leverages homograph attacks, exploiting Unicode characters to mimic SafePal’s official branding (s1-safepal.co.com) and deceive victims into entering sensitive credentials or downloading malware. The threat actor registered the domain to impersonate SafePal’s legitimate wallet service, aiming to harvest private keys, seed phrases, or login details under the guise of a security update or wallet verification. Users lured to this page face immediate credential theft risks, financial loss, or account takeover if they input any information. This domain was flagged by PhishDestroy’s automated threat intelligence pipeline with a status of 'under_investigation' and an active risk level. Technical analysis reveals the domain resolves to IP 104.21.43.229 and utilizes a Let’s Encrypt SSL certificate to appear legitimate. The domain exhibits 0 detections out of 95 VirusTotal scans, indicating it remains undetected by most antivirus engines as of the latest update. The domain was recently registered via an anonymized registrar and has not yet been blocklisted by major threat intelligence platforms, increasing its potential reach and effectiveness in phishing campaigns. The combination of a legitimate-looking SSL certificate, low detection rates, and brand impersonation tactics makes this a high-risk domain for cryptocurrency users. If you have visited wallet.s1-safepal.co.com, immediately disconnect from the internet and audit your cryptocurrency wallets and exchange accounts for unauthorized transactions or login attempts. Revoke any session tokens or API keys exposed during the visit. Use a trusted password manager to change all reused or exposed passwords linked to SafePal or related services. Report the domain to your local cybersecurity authority or SafePal’s official support channels. Enable two-factor authentication (2FA) on all cryptocurrency-related accounts and consider transferring funds to a hardware wallet if you suspect exposure. Monitor your accounts closely for 30 days post-visit due to the persistent risk of credential harvesting or secondary phishing attacks.