my-safepal[.]io

This domain, my-safepal.io, poses as the official SafePal Wallet application download portal but is designed to distribute counterfeit software or steal cryptocurrency credentials. Visitors are presented with a replica of the legitimate SafePal website, including download links for desktop and mobile applications. The site specifically targets users of the Across protocol, a cross-chain bridge service, by impersonating SafePal's branding to exploit trust in both platforms. Analysis indicates this is not an official SafePal resource but a fraudulent operation intended to compromise digital wallets and private keys. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered on November 17, 2025, through Hosting Concepts B.V. d/b/a Registrar.eu, with no SSL certificate present to encrypt user connections. It resolves to the IP address 186.2.171.37, located in Russia under AS59692 (IQWeb FZ-LLC). Security vendors have flagged this domain extensively, with 9 out of 95 engines on VirusTotal detecting it as malicious. Additionally, the domain appears on one security blocklist, specifically PhishDestroy, further corroborating its classification as a phishing resource. Users who visited my-safepal.io should assume potential exposure of sensitive information. Immediately disconnect any devices that interacted with the site from the internet and avoid executing any downloaded files. Reset passwords for all cryptocurrency wallets and associated accounts using a separate, trusted device. Enable multi-factor authentication where available and monitor wallet transactions for unauthorized activity. If private keys or recovery phrases were entered on the site, transfer remaining assets to a new wallet with fresh credentials. Report the incident to relevant security teams, including the impersonated brand's official support channels, to assist in mitigation efforts.