app-safepal[.]github[.]io

This domain, app-safepal.github.io, is actively engaged in brand impersonation targeting users of the Curve financial platform. Analysis confirms the threat type as a fraudulent cryptocurrency wallet interface, specifically mimicking the Safepal Wallet under the guise of official affiliation. The domain remains operational as of the latest assessment, presenting a high-risk vector for credential harvesting and asset diversion. Infrastructure analysis reveals critical technical indicators: the domain is flagged by 9 of 95 security vendors on VirusTotal, indicating widespread detection. It is registered through MarkMonitor, Inc., with a creation date of February 21, 2026, suggesting either a typographical error in records or an attempt to obscure provenance. The domain resolves to IP address 185.199.111.153, hosted on AS54113 (Fastly, Inc.) in the United States. A Let's Encrypt SSL certificate (R12) is deployed, providing a superficial layer of legitimacy. The domain appears on one security blocklist and is blocked by PhishDestroy, further corroborating its malicious classification. The page title, 'Safepal Wallet € | Official,' explicitly leverages brand recognition to deceive users. Current status confirms the domain remains active, posing an ongoing threat to unsuspecting users. Organizations and individuals are advised to implement immediate countermeasures: block the domain and its resolving IP at the network perimeter, update endpoint protection rules to include this indicator, and alert user bases to the fraudulent nature of the site. Security teams should monitor for related infrastructure, such as subdomains or associated IP ranges, and report findings to relevant threat intelligence platforms. Users who may have interacted with the domain should revoke any connected wallet permissions, rotate credentials, and conduct a thorough audit of linked accounts for unauthorized activity.