safepal--feqwallet[.]pages[.]dev

This domain, safepal--feqwallet.pages.dev, is actively engaged in brand impersonation targeting SafePal, a legitimate cryptocurrency wallet provider. The threat type is classified as high-risk brand impersonation, designed to deceive users into interacting with fraudulent wallet services or disclosing sensitive credentials. As of the latest assessment, the domain remains operational and unmitigated. Analysis of the domain's infrastructure reveals multiple technical indicators of malicious activity. The domain was registered through Cloudflare, Inc. on April 27, 2026, and resolves to the IP address 188.114.96.3, located in Canada under Cloudflare's network. The SSL certificate is issued by Google Trust Services (WE1), a common feature among both legitimate and malicious sites leveraging Cloudflare's infrastructure. Security vendors have flagged this domain, with 1 out of 95 VirusTotal engines detecting it as malicious. Additionally, the domain appears on one security blocklist, further corroborating its fraudulent nature. The page title, 'SafePal Wallet Guide | Your All-in-One Multi-Chain Crypto Companion,' is crafted to mimic official SafePal branding, increasing the likelihood of user deception. The current status of safepal--feqwallet.pages.dev remains active, posing an ongoing risk to users who may encounter it through phishing campaigns, malicious advertisements, or search engine manipulation. Given the high-risk nature of this impersonation, immediate action is recommended. Users should avoid interacting with the domain, and security teams should block access to the IP address 188.114.96.3 and the domain itself within network security controls. Organizations are advised to monitor for additional domains leveraging similar naming conventions or Cloudflare-hosted infrastructure. Enhanced user education on verifying official wallet sources and recognizing impersonation tactics is critical to mitigating this threat.