safepal-wallet-en[.]pages[.]dev

This domain presents a high-risk brand impersonation threat targeting SafePal, a cryptocurrency wallet provider. Analysis indicates the site mimics legitimate SafePal wallet services, including download, setup, security features, and NFT swaps, to deceive users into interacting with malicious infrastructure. The objective appears to be crypto asset theft through fraudulent wallet software or credential harvesting, enabling unauthorized access to victims' digital assets and private keys. Infrastructure analysis reveals the domain safepal-wallet-en.pages.dev was registered through Cloudflare, Inc. on April 30, 2026, and currently resolves to the IP address 188.114.96.3, located in Canada and associated with Cloudflare's network. Detection metrics show minimal coverage, with only 1 out of 95 security vendors flagging the domain on VirusTotal. The domain appears on a single security blocklist and is currently blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services, using the WE1 intermediate, which aligns with Cloudflare Pages' standard deployment but does not mitigate the underlying threat. Users who have visited safepal-wallet-en.pages.dev should immediately cease all interaction and avoid downloading any software or entering credentials. Any cryptocurrency wallets accessed or installed via this domain should be considered compromised. Affected individuals should transfer remaining assets to a new, verified wallet using a clean device, revoke all connected dApp permissions, and monitor transaction histories for unauthorized activity. Security teams are advised to update blocklists with the domain and IP address 188.114.96.3 to prevent further exposure within protected networks.