safeqeep[.]com

This domain, safeqeep.com, is identified as a fraudulent cryptocurrency wallet phishing site designed to impersonate legitimate self-custodial DeFi and NFT wallet services. The page title, 'SafeQeep | Self-custodial Wallet for DeFi, dApps & NFTs on Geeq,' suggests an attempt to deceive users into believing it is a genuine platform for managing digital assets on the Geeq blockchain. Analysis indicates the site likely operates as a wallet drainer, tricking victims into connecting their wallets to malicious smart contracts that siphon funds. No legitimate association with Geeq or established DeFi services has been verified, and the domain exhibits characteristics typical of phishing infrastructure targeting cryptocurrency users. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain was registered on February 21, 2026, through Porkbun LLC, a registrar frequently utilized in phishing campaigns. It resolves to the IP address 172.67.216.228, which is associated with Cloudflare services, a common obfuscation tactic to conceal hosting origins. Detection metrics show a VirusTotal score of 2/95 security vendors flagging the domain, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and is blocked by PhishDestroy. Technologies detected include Bootstrap, jQuery, and Cloudflare Browser Insights, further aligning with patterns observed in phishing sites leveraging content delivery networks for scalability and resilience. As of the latest assessment, safeqeep.com has been taken offline, reducing immediate exposure to potential victims. However, the domain remains registered, and the infrastructure could be reactivated or repurposed for future phishing operations. Users who interacted with the site prior to its takedown may still be at risk of financial loss or credential compromise. Recommendations include monitoring wallet transactions for unauthorized activity, revoking any connected dApp permissions, and verifying domain authenticity through official sources before engaging with cryptocurrency platforms. The low detection rate on VirusTotal underscores the need for heightened vigilance, as emerging phishing domains often evade initial security scans.