safepal-ai[.]com

This domain, safepal-ai.com, has been identified as a high-risk brand impersonation threat targeting SafePal, a cryptocurrency service. The domain was registered on February 21, 2026, and is currently active, indicating ongoing malicious operations. Analysis reveals that the domain is hosted by Cloudflare, Inc., with an IP address of 172.67.165.2 located in the United States. The site uses Node.js, Envoy, Express, and HSTS, which suggests a well-structured and potentially sophisticated infrastructure. The SSL certificate is issued by GoDaddy.com, Inc., under the Go Daddy Secure Certificate Authority - G2, a common choice for legitimate and malicious sites alike. Despite the use of these technologies, the domain has a Gridinsoft trust score of 0/100, indicating a strong likelihood of malicious intent. The domain is also flagged by 2 out of 95 security vendors on VirusTotal, and it appears on one security blocklist, specifically PhishDestroy. These factors collectively point to a high risk of the domain being used for phishing attacks, particularly in the context of cryptocurrency scams. Defenders should block access to this domain and monitor for any related indicators of compromise. The nameservers for the domain are ns1.afternic.com and ns2.afternic.com, and it is registered through Edomains LLC. The exact content of the site has not yet been analyzed, but the combination of the domain name and the technical indicators strongly suggests that it is designed to deceive users into believing they are interacting with SafePal.