safepal[.]news

Analysis of safepal.news on July 24, 2026 identifies this domain as a brand-impersonation phishing site targeting cryptocurrency users. The page title, 'SafePal Crypto Hardware Wallet (Official) | The best wallet to protect your assets,' directly mimics the SafePal brand, though the domain itself is not affiliated with the legitimate SafePal wallet provider. Infrastructure analysis reveals the domain was hosted behind Cloudflare nameservers (garret.ns.cloudflare.com and lucy.ns.cloudflare.com) and resolved to IP 188.114.97.3, part of AS13335 (Cloudflare, Inc.) in the United States. No SSL certificate was present at the time of assessment, increasing the risk of interception for any transmitted credentials.

The domain appears on one security blocklist (PhishDestroy) and was flagged by a single vendor on VirusTotal, indicating limited but confirmed detection. The scam type is classified as wallet/seed phishing, suggesting the site was designed to harvest cryptocurrency wallet recovery phrases or private keys. As of the report date, safepal.news is offline, though defenders should treat any reactivation as a high-priority threat. Defenders are advised to block the domain and its resolving IP at network and endpoint levels.

Security teams should monitor for connections to 188.114.97.3 or DNS queries to the Cloudflare nameservers associated with this campaign. Given the absence of SSL and the use of Cloudflare, traffic inspection may be challenging, but network logs should be reviewed for any historical connections to this infrastructure. No additional brand targets beyond SafePal are confirmed, though the 'across' label in the intelligence suggests potential secondary targeting of cross-chain or bridging services. The exact content and functionality of the site remain unanalyzed, but the page title and scam classification provide sufficient evidence for proactive mitigation.