www-safepal[.]com

Analysis indicates that the domain www-safepal.com was registered on 21 February 2026 through Web Commerce Communications Limited operating as WebNic.cc. The authoritative nameservers ns100.webnic.cc and ns101.webnic.cc resolve the domain to the IPv4 address 216.120.147.200, which is hosted by Bodis, LLC in the United States. The IP address appears on a single security blocklist and has been flagged by PhishDestroy as part of a crypto‑related brand‑impersonation campaign. VirusTotal scans show that 15 of 93 security vendors assign a malicious verdict to the domain, reflecting a moderate detection rate.

The Gridinsoft trust score of 20 out of 100 further confirms a low reputation. AlienVault OTX contains the domain in one threat‑intelligence pulse, providing additional corroboration of its malicious use. The domain is explicitly listed as impersonating the cryptocurrency wallet brand SafePal and is categorized as a crypto scam. As of the report date, the site is taken offline, but historical activity suggests it was used to lure victims into fraudulent cryptocurrency transactions.

Defenders should add www-safepal.com to deny‑list rules, block the associated IP 216.120.147.200 at network perimeters, and monitor for any residual traffic targeting the nameservers. Continuous retrieval of threat‑intel feeds, including PhishDestroy, OTX, and VirusTotal, is recommended to capture any re‑hosting attempts. Because no page‑title or content snapshot is available, further forensic analysis of any cached copies would be required to confirm the exact lure techniques employed.