update-safepal[.]com

Analysis of update-safepal.com indicates that the domain was registered on 13 March 2026 through NiceNIC International Group Co., Limited. The authoritative nameservers aaron.ns.cloudflare.com and gabriella.ns.cloudflare.com point the domain to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site presented a TLS certificate issued by Let’s Encrypt (certificate identifier E8), confirming the use of encrypted HTTPS connections. The page title observed in the limited snapshot reads “SafePal Crypto Hardware Wallet (Official) | The best wallet to protect your assets”, and the intelligence tags the campaign as a crypto‑related scam that impersonates the Binance brand.

Gridinsoft assigned a trust score of 0 out of 100, and AlienVault OTX references the domain in two separate threat‑intel pulses. PhishDestroy has listed the domain as blocked, and it appears on one additional security blocklist. VirusTotal reported a single positive detection out of ninety‑five scanning engines. The domain is currently offline, and no further HTTP response data are available.

The available evidence confirms that the infrastructure is typical of a fast‑flux or CDN‑based phishing operation, leveraging Cloudflare’s edge network to hide the origin server. The low trust score, the presence on multiple blocklists, and the single VirusTotal detection collectively suggest malicious intent, although the limited detection count leaves some uncertainty about the breadth of exposure. Defenders should continue to block the domain at network perimeter devices, update URL filtering feeds with the domain and its associated IP, and monitor for any re‑registration attempts. Additional analysis of the original page content, if recovered from archives, would be required to fully characterize the phishing vector and any credential‑harvesting mechanisms.