antiresolve-mysafpalnode[.]pages[.]dev

PhishDestroy identifies antiresolve-mysafpalnode.pages.dev as an active crypto drainer posing as Safepal wallet infrastructure. The domain leverages Cloudflare Pages to host a deceptive interface designed to trick users into connecting their wallets and authorize malicious transactions. Security telemetry reveals the domain is equipped with a drainer kit targeting cryptocurrency holders through fraudulent transaction signing prompts. While the infrastructure mimics legitimate Safepal wallet services, no direct affiliation with Safepal Wallet exists.

This domain was flagged by PhishDestroy with a VirusTotal detection score of 2 out of 95 engines as of the latest scan. It was registered via Cloudflare, Inc. and resolves to IP 188.114.97.3. The domain operates under a Google Trust Services SSL certificate, suggesting an attempt to mimic legitimate HTTPS infrastructure. A review of threat intelligence platforms shows no prior inclusion in major blocklists at this time. The absence of detections highlights the evasive nature of this campaign, which has likely been active for a short period given its current status.

At present, antiresolve-mysafpalnode.pages.dev remains active and is actively distributing a crypto drainer targeting unsuspecting users. Response actions include continuous monitoring and sharing of IOCs with trusted intelligence partners and CERT teams. Despite its current low detection rate, the risk level remains classified as under investigation due to the potential for rapid escalation once the campaign gains broader exposure. Users are strongly advised to avoid this domain entirely and verify wallet URLs through official Safepal channels. Blocking the IP 188.114.97.3 at the network perimeter is recommended to prevent access from internal systems. Remaining risk includes the threat of new drainer variants emerging under similar infrastructure, necessitating ongoing vigilance and proactive threat hunting.