safepol[.]gr[.]com

The domain safepol.gr.com is currently active and returns HTTP 200. Its SSL certificate is issued by Google Trust Services under the WE1 identifier. DNS resolution points to 188.114.97.3, an address owned by Cloudflare, Inc. in Canada. The domain is registered through Key‑Systems GmbH and uses the nameservers ns1.centralnic.net, ns2.centralnic.net, ns3.centralnic.net and ns4.centralnic.net. Automated analysis identifies Cloudflare Browser Insights, Cloudflare and HTTP/3 as the underlying technologies. The page title observed is “Millbrook Candle Workshop”, but no further content has been examined. Threat intelligence tags the site as a SafePal brand‑impersonation campaign. Five of ninety‑one VirusTotal scanners flagged the domain, and it is listed on three public blocklists. Defensive products PhishDestroy, MetaMask and SEAL have already blocked the domain. The Gridinsoft trust score is 0/100, indicating a high likelihood of malicious intent. While the exact phishing page layout is unknown, the combination of brand impersonation, low trust score, multiple blocklist entries and partial VirusTotal detections warrants immediate mitigation. Organizations should add safepol.gr.com to URL filtering rules, monitor DNS queries for the associated IP, and consider sink‑holing or null‑routing the address to prevent user exposure.