safecas[.]com

The domain safecas.com is a phishing site engaged in brand impersonation targeting Ethereum users. It presents itself as a legitimate Ethereum-related service but is designed to deceive victims into disclosing sensitive information or transferring assets. No drainer kit was identified in this campaign. The site is currently taken offline, reducing immediate risk, though prior visitors may remain exposed.

Technical indicators confirm safecas.com as a malicious domain. As of analysis, 3 of 95 VirusTotal security vendors flagged the domain, including alphaMountain.ai, Fortinet, and SOCRadar. The domain appears on 1 security blocklist (PhishDestroy) and is registered through MAT BAO CORPORATION, created on July 21, 2025. It resolves to IP address 57.129.97.29, hosted on AS16276 (OVH SAS) in Germany. No SSL certificate is present, and the observed page title reads 'SAFECAS | Enter the world of sport and stakes!'. Nameservers are celeste.ns.cloudflare.com and sage.ns.cloudflare.com. Google Safe Browsing has not flagged the domain, and Gridinsoft assigns a trust score of 0/100.

Individuals who interacted with safecas.com should take immediate safety steps. If cryptocurrency wallet access was granted, revoke all token approvals and transfer funds to a new wallet. For credential exposure, change passwords on all accounts where the same credentials were used, enable two-factor authentication, and monitor for unauthorized transactions or account activity. Report the domain to Ethereum’s official security channels, submit it to Google Safe Browsing, and notify local cybercrime authorities or consumer protection agencies to aid in takedown efforts.