sf-epal[.]com

The domain sf-epal.com was registered on February 21, 2026 through Web Commerce Communications Limited dba WebNic.cc and is currently listed as offline. DNS records point to Cloudflare, Inc. (CA) with the resolver IP 104.21.46.149 and authoritative name servers ns100.webnic.cc and ns101.webnic.cc. The page title observed in intelligence is "www.sf-epal.com" and the site is classified as a brand‑impersonation campaign targeting SafePal. Threat intelligence sources indicate that the domain has been cited in 13 AlienVault OTX pulses and appears on one security blocklist.

It has been actively blocked by the PhishDestroy mitigation service. VirusTotal analysis shows that 13 of 93 security vendors have flagged the domain as malicious. These data points collectively confirm that sf-epal.com has been used in a targeted brand‑impersonation operation, likely intended to deceive users of the SafePal cryptocurrency wallet service.

While the site is presently taken offline, the infrastructure—particularly the use of Cloudflare’s network and the WebNic.cc registrar—may be reused for future campaigns. Defenders should add sf-epal.com to domain blocklists, monitor for re‑registration or similar sub‑domains, and enforce URL filtering rules that reference the observed page title and IP address. Continuous monitoring of OTX feeds, VirusTotal detections, and PhishDestroy updates is recommended to capture any resurgence of the threat actor's activity.