safedao[.]pages[.]dev

PhishDestroy identifies safedao.pages.dev as an active impersonation phishing domain designed to mimic legitimate DAO portals. Hosted on Cloudflare Pages with Google Trust Services SSL, the site leverages deceptive branding to trick users into connecting wallets or submitting credentials. Risk level remains elevated due to persistent phishing TTPs noted across multiple security stacks.

Security telemetry confirms exposure across the attack surface with VirusTotal reporting detection by only 1 out of 95 engines, a clear indicator of low signature coverage despite community awareness. Registrar data ties the domain to Cloudflare, Inc., resolving to 172.66.44.71, while cross-referencing against Enkrypt and ScamSniffer blocklists confirms malicious categorization. The Google Trust Services certificate grants superficial legitimacy, masking credential harvesting attempts under HTTPS encryption.

Mitigation pivots on immediate domain blocking and user advisories against wallet connections or login prompts. Organizations should push IOCs (172.66.44.71, safedao.pages.dev) into egress filters and browser policies, disable autofill on crypto-related forms, and verify site authenticity via official DAO channels. Wallet extensions such as Enkrypt or ScamSniffer should be enabled to blocklisted domains to preempt user interaction. PhishDestroy recommends treating this as active, ongoing phishing infrastructure requiring swift containment.