safepalwallett[.]pages[.]dev

The domain safepalwallett.pages.dev is flagged as a confirmed brand impersonation targeting the Aave brand. This domain impersonates the SafePal Wallet, a legitimate cryptocurrency management platform, potentially to deceive users into revealing sensitive information or downloading malicious software.

Infrastructure analysis reveals that safepalwallett.pages.dev has a VirusTotal detection score of 0/95, indicating that it has not been flagged by antivirus engines yet. The domain is registered through Cloudflare, Inc., and resolves to the IP address 172.66.47.9, which is located in the US and is part of Cloudflare's network (AS13335). The domain was created on September 10, 2025, and its SSL certificate is issued by Google Trust Services / WE1. The site appears on 1 security blocklist and is specifically blocked by PhishDestroy.

Currently, the domain remains active and poses a significant risk to users due to its ability to mimic a legitimate platform. Security teams are advised to monitor this domain and update their blocklists accordingly. Users should exercise extreme caution and verify the URL and SSL certificate before entering any sensitive information. The domain's low detection count on VirusTotal suggests that it may be a relatively new or sophisticated threat, necessitating further investigation and proactive security measures.