safe-pal[.]app

The domain safe-pal.app is actively serving HTTP content (status 200) over TLS using a Let’s Encrypt certificate. DNS resolution points to IP 194.61.120.209, which belongs to the BlueVPS OU network in the Netherlands (AS62005). The domain was registered on May 29, 2026 through Spaceship, Inc., and its authoritative nameservers are launch1.spaceship.net and launch2.spaceship.net. Infrastructure fingerprinting reveals a WordPress site backed by MySQL, PHP, and Nginx, a common stack for credential‑collection pages. The site appears on three security blocklists and is specifically blocked by PhishDestroy, MetaMask, and SEAL, indicating that defensive feeds have identified it as a brand‑impersonation threat targeting SafePal. VirusTotal scans show two of ninety‑one security vendors flag the domain, and Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. While the exact page content has not been examined, the combination of brand‑impersonation classification, active hosting, low trust score, and multiple blocklist listings suggests a high‑risk operation. Defenders should block the domain at network perimeters, monitor DNS queries for the associated IP and nameservers, and consider sinkholing the host to disrupt traffic. Continuous re‑evaluation is advised to capture any changes in payload or hosting infrastructure.