safevaults[.]eu[.]com

PhishDestroy identifies safevaults.eu.com as an elevated-risk crypto drainer domain actively engaged in phishing campaigns. The domain mimics legitimate vault services to trick users into connecting crypto wallets, enabling unauthorized fund transfers. No specific drainer kit has been linked publicly, but the infrastructure aligns with common crypto wallet-draining operations.

This domain resolves to IP 104.21.38.45 and is flagged by 1 out of 95 VirusTotal security vendors. The registrar remains unverified in public WHOIS data, and the domain’s SSL certificate was issued by Let’s Encrypt. PhishDestroy records show the domain was created recently and has already appeared on 2 security blocklists, including Google Safe Browsing (GSB) and at least one additional third-party list. Blocking by MetaMask and SEAL indicates active detection by major crypto-security platforms.

As of the latest scan, safevaults.eu.com remains active, with elevated risk due to its crypto-draining objective and confirmed presence on multiple blocklists. Users who encounter this domain should avoid interaction and verify its status on PhishDestroy. The remaining risk is high given the domain’s live status and the potential for rapid infrastructure changes to evade detection. Regular monitoring and community reporting remain critical to mitigating further abuse.