safpal-guide-e[.]pages[.]dev

Analysis indicates the domain safpal-guide-e.pages.dev is actively impersonating SafePal, a cryptocurrency wallet provider, as of July 12, 2026. The domain was registered on May 6, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3. Infrastructure analysis reveals the use of Cloudflare services, including HSTS and HTTP/3, alongside a SSL certificate issued by Google Trust Services. The page title, 'SafePal Wallet – 𝕊𝔼ℂ𝕌ℝ𝔼, Multi-Chain Cryptocurrency Wallet,' directly mirrors SafePal’s branding, suggesting an intent to deceive users into believing the site is legitimate. The domain appears on one security blocklist, with a Gridinsoft trust score of 0/100, indicating high suspicion. While 95 security vendors have scanned the domain via VirusTotal, none currently flag it as malicious; however, the absence of detections does not confirm safety. The domain remains active and unmitigated, posing a potential risk to users who may interact with it under the assumption of authenticity. Defenders are advised to monitor network traffic for connections to 188.114.96.3 and the domain itself, as well as to assess user reports of exposure. Given the domain’s recent registration and brand impersonation, further investigation into its payload and distribution methods is warranted. No additional details regarding the specific content or functionality of the site are currently available for analysis.