SafePal

Crypto & web3safepal.comRank 200 of the most impersonated
Cert findings · 24 h
4
Cert findings · 7 days
14
6 reported or listed · 8 on phishing hosts
Registered lookalikes
91
18 listed by a source or an address list
Official domains
2
verified from SafePal's own sites and records

Certificate findings for SafePal

Updated hourly · 2026-11-05 10:53 UTC

DomainSpoof matched these hostnames, from public certificate logs, to SafePal's name or to lookalike spellings of its official domains. Each was reported or listed by one of our sources, or resolved to an address on Spamhaus DROP or DomainSpoof's phishing-host list.

Published now · 26 findings, grouped by hostname

  1. safepal2026.com HK · AS133380 · Layerstack Limited
    ReportedPhishing hostReported by PhishDestroy · Address hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 9 mo ago
    DetailsHide
    Hostname
    safepal2026.com
    First seen
    2026-11-05 00:45 UTC
    First published
    2026-11-05 01:50 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 02:00 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 123.176.98.182.
    1. Phishing-host list fetched with the address
    2. Resolved to 123.176.98.182
    3. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-04 23:44 UTC to 2027-02-02 23:44 UTC
    Logged 2026-11-05 00:43 UTC in IPng Networks Gouda2027h1, entry 319,658,513
    SHA-256 3b8eb59550674129df2ebefc28d440aea99b71caced3d74812a6e3c45806c179
    Public key SHA-256 c03cbc2494a494c4cb395fa3740a096ddd7375c5eca6d13df37cce6f53927b63
    PhishDestroy
    Brand
    SafePal
    Addresses
    123.176.98.182 · Hong Kong · AS133380 LAYER-AS - Layerstack Limited
    Domain
    safepal2026.com
    Registered
    2026-02-06 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 01:50 UTC

    Suggest a correction

  2. www.wal-phantom-wallat.us.safepal-wallat.us US · AS53667 · FranTech Solutions
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 4 d ago
    DetailsHide
    Hostname
    www.wal-phantom-wallat.us.safepal-wallat.us
    First seen
    2026-11-01 18:06 UTC
    First published
    2026-11-01 19:10 UTC
    DNS
    Resolves · checked 2026-11-04 19:20 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 198.251.89.30.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 198.251.89.30
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-01 17:04 UTC to 2027-01-30 17:04 UTC
    Logged 2026-11-01 18:03 UTC in Google PlumbersArms2027h1, entry 559,478,114
    SHA-256 108e0f8f51d87a097838dd8935f3f0a15ed8dcb18e89db8c7edb07986c73903b
    Public key SHA-256 242a8584308894aad737f5b50118dee2e8aee116dd7e8bf8fec825e2e1757246
    Brand
    SafePal
    Addresses
    198.251.89.30 · United States · AS53667 PONYNET - FranTech Solutions
    Domain
    safepal-wallat.us
    Registered
    2026-11-01 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at safepal-wallat.us
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 17:09 UTC

    Suggest a correction

  3. wal-phantom-wallat.us.safepal-wallat.us US · AS53667 · FranTech Solutions
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 4 d ago
    DetailsHide
    Hostname
    wal-phantom-wallat.us.safepal-wallat.us
    First seen
    2026-11-01 18:06 UTC
    First published
    2026-11-01 19:10 UTC
    DNS
    Resolves · checked 2026-11-04 19:20 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 198.251.89.30.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 198.251.89.30
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-01 17:04 UTC to 2027-01-30 17:04 UTC
    Logged 2026-11-01 18:03 UTC in Google PlumbersArms2027h1, entry 559,478,114
    SHA-256 108e0f8f51d87a097838dd8935f3f0a15ed8dcb18e89db8c7edb07986c73903b
    Public key SHA-256 242a8584308894aad737f5b50118dee2e8aee116dd7e8bf8fec825e2e1757246
    Brand
    SafePal
    Addresses
    198.251.89.30 · United States · AS53667 PONYNET - FranTech Solutions
    Domain
    safepal-wallat.us
    Registered
    2026-11-01 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at safepal-wallat.us
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 17:09 UTC

    Suggest a correction

  4. safepal-wallat.us US · AS53667 · FranTech Solutions
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 4 d ago
    DetailsHide
    Hostname
    safepal-wallat.us
    First seen
    2026-11-01 18:06 UTC
    First published
    2026-11-01 19:10 UTC
    DNS
    Resolves · checked 2026-11-04 19:20 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 198.251.89.30.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 198.251.89.30
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-01 17:04 UTC to 2027-01-30 17:04 UTC
    Logged 2026-11-01 18:03 UTC in Google PlumbersArms2027h1, entry 559,478,114
    SHA-256 108e0f8f51d87a097838dd8935f3f0a15ed8dcb18e89db8c7edb07986c73903b
    Public key SHA-256 242a8584308894aad737f5b50118dee2e8aee116dd7e8bf8fec825e2e1757246
    Brand
    SafePal
    Addresses
    198.251.89.30 · United States · AS53667 PONYNET - FranTech Solutions
    Domain
    safepal-wallat.us
    Registered
    2026-11-01 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at safepal-wallat.us
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 17:09 UTC

    Suggest a correction

  5. webmail.safepal-wallat.us US · AS53667 · FranTech Solutions
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 4 d ago
    DetailsHide
    Hostname
    webmail.safepal-wallat.us
    First seen
    2026-11-01 16:17 UTC
    First published
    2026-11-01 16:25 UTC
    DNS
    Resolves · checked 2026-11-04 16:31 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 198.251.89.30.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 198.251.89.30
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-01 15:12 UTC to 2027-01-30 15:12 UTC
    Logged 2026-11-01 16:10 UTC in Google PlumbersArms2027h1, entry 558,192,824
    SHA-256 723e17a1f57295182a15f1187010b0c52b481109b70687316d2a228d9f751cd4
    Public key SHA-256 b694995d190b834d158af64ef615279648caf07bd75b4f35ebe4699ad5fbbad7
    Brand
    SafePal
    Addresses
    198.251.89.30 · United States · AS53667 PONYNET - FranTech Solutions
    Domain
    safepal-wallat.us
    Registered
    2026-11-01 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at safepal-wallat.us
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 17:09 UTC

    Suggest a correction

  6. safepalteam.com BD · AS153377 · Extent Technologies Limited
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 2 mo ago
    DetailsHide
    Hostname
    safepalteam.com
    First seen
    2026-10-31 17:01 UTC
    First published
    2026-10-31 17:58 UTC
    DNS
    Resolves · checked 2026-11-04 18:11 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 163.61.237.11.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 163.61.237.11
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-10-31 16:00 UTC to 2027-01-29 16:00 UTC
    Logged 2026-10-31 16:59 UTC in IPng Networks Gouda2027h1, entry 279,542,091
    SHA-256 927a5da1cdc6d3ee3af4fb88ce4d07d56ba19cb6fe00371edce6bb34020611a6
    Public key SHA-256 8236b4ea9a16cd9b59d721a3082b527eb905b3a510e42ec7986b953d41ac4ea8
    Brand
    SafePal
    Addresses
    163.61.237.11 · Bangladesh · AS153377 ETL-AS-AP - Extent Technologies Limited
    Domain
    safepalteam.com
    Registered
    2026-08-31 · TuringSign Inc. d/b/a Cosmotown
    MX
    Receives mail at safepalteam.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 19:26 UTC

    Suggest a correction

  7. www.eng-safepal.org GB · AS197574 · EXPRESSHOST ExpressHost Ltd3 addresses
    ListedPhishing hostUnder eng-safepal.org, listed by MetaMask · Address hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 8 d ago
    DetailsHide
    Hostname
    www.eng-safepal.org
    First seen
    2026-10-31 08:16 UTC
    First published
    2026-10-31 08:21 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-29 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 08:32 UTC
    Listed
    MetaMask, listing eng-safepal.org and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 154.86.119.115.
    1. Phishing-host list fetched with the address
    2. Resolved to 154.86.119.115
    Certificate
    Issued by YR1
    Valid 2026-10-31 07:14 UTC to 2027-01-29 07:14 UTC
    Logged 2026-10-31 08:13 UTC in Google ParcelYard2027h1, entry 535,833,943
    SHA-256 a4a48af989ff3ef786b70237af3b6ea1e28939bab20609bc193bf3026384e0e8
    Public key SHA-256 4012fa289a0ce1e7bee4d3ac99c61bfcc25eb96b47163e69f59cd08831fa1f45
    Brand
    SafePal
    Addresses
    154.86.119.115 · United Kingdom · AS197574 EXPRESSHOST ExpressHost Ltd
    31.59.175.142 · Hong Kong · AS56971 AS56971 CGI GLOBAL LIMITED
    87.232.123.231 · United Kingdom · AS198550 nodehost-as NODE HOST LIMITED
    Domain
    eng-safepal.org
    Registered
    2026-10-28 · Key-Systems GmbH
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 01:16 UTC

    Suggest a correction

  8. safepal.exchange US · AS16509 · Amazon.com, Inc.
    ListedAmazon Web ServicesListed by MetaMaskMX presentSPF ~allDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    safepal.exchange
    First seen
    2026-10-31 01:15 UTC
    First published
    2026-10-31 01:50 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · delisted on 2026-11-04
    PhishDestroy: first observed in the feed 2026-10-25 · delisted on 2026-11-01
    DNS
    Resolves · checked 2026-11-05 01:55 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-10-31 00:16 UTC to 2027-01-29 00:16 UTC
    Logged 2026-10-31 01:14 UTC in DigiCert Wyvern2027h1, entry 364,060,070
    SHA-256 5d6512636be4c5d7b27d85863ac915600d5f523c2bf44e720eaf07eaa5966193
    Public key SHA-256 4c27661a20334095091203b98aeeff5ee9d6acd4d28b8017c3f7fcabd45ef445
    Brand
    SafePal
    Addresses
    216.198.79.1 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (216.198.79.1): a cloud provider. It rents servers and addresses to its customers.
    Domain
    safepal.exchange
    Registered
    2026-03-13 · NameCheap, Inc.
    MX
    Receives mail at eforward1.registrar-servers.com, eforward2.registrar-servers.com, eforward3.registrar-servers.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  9. www.safepal.exchange US · AS16509 · Amazon.com, Inc.2 addresses
    ListedAmazon Web ServicesUnder safepal.exchange, listed by MetaMaskMX presentSPF ~allDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    www.safepal.exchange
    First seen
    2026-10-31 01:15 UTC
    First published
    2026-10-31 01:50 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · delisted on 2026-11-04
    PhishDestroy: first observed in the feed 2026-10-25 · delisted on 2026-11-01
    DNS
    Resolves · checked 2026-11-05 01:55 UTC
    Listed
    MetaMask, listing safepal.exchange and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-10-31 00:16 UTC to 2027-01-29 00:16 UTC
    Logged 2026-10-31 01:15 UTC in Google PlumbersArms2027h1, entry 532,117,851
    SHA-256 1bf00b690a6103d5bad182026fbe7bba20447f747f7af02975cf43fc7d42f6ea
    Public key SHA-256 7d72288bbe4351aa33b80cbc4a6f1e5e3651ba76de227d7d07f1fb73d173f524
    Brand
    SafePal
    Addresses
    64.29.17.65 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    216.198.79.65 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (64.29.17.65, 216.198.79.65): a cloud provider. It rents servers and addresses to its customers.
    Domain
    safepal.exchange
    Registered
    2026-03-13 · NameCheap, Inc.
    MX
    Receives mail at eforward1.registrar-servers.com, eforward2.registrar-servers.com, eforward3.registrar-servers.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  10. safepal.live US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 3 y ago
    DetailsHide
    Hostname
    safepal.live
    First seen
    2026-10-30 09:16 UTC
    First published
    2026-10-30 09:42 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · delisted on 2026-11-04
    DNS
    Resolves · checked 2026-11-05 09:51 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-10-30 08:11 UTC to 2027-01-28 09:09 UTC
    Logged 2026-10-30 09:11 UTC in Google PlumbersArms2027h1, entry 520,741,966
    SHA-256 4d0b75cf71d074a57a2d315577edafa497edce15c686fc54b15352396c651c88
    Public key SHA-256 0496e0a450f4bff53fd6cd52856993b487c7c40a6247ce98af4b56904d39ba1c
    Brand
    SafePal
    Addresses
    104.21.48.94 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.183.64 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3035::6815:305e
    2606:4700:3035::ac43:b740
    Cloudflare
    Cloudflare (104.21.48.94, 172.67.183.64): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    safepal.live
    Registered
    2023-09-09 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 09:49 UTC

    Suggest a correction

  11. eng-safepal.org GB · AS197574 · EXPRESSHOST ExpressHost Ltd3 addresses
    ListedPhishing hostListed by MetaMask · Address hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 8 d ago
    DetailsHide
    Hostname
    eng-safepal.org
    First seen
    2026-10-29 23:44 UTC
    First published
    2026-10-30 00:48 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-29 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 00:53 UTC
    Listed
    MetaMask
    1. Certificate logged in CT
    2. Observed in the MetaMask feed
    3. We matched the new listing
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 154.86.119.115.
    1. Phishing-host list fetched with the address
    2. Resolved to 154.86.119.115
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-10-28 07:47 UTC to 2027-01-26 07:47 UTC
    Logged 2026-10-28 08:46 UTC in DigiCert Sphinx2027h1, entry 292,617,747
    SHA-256 0125b9200b2c9d9183118c837f935e80aa6f180995c97c10390c7fc065ec0ea3
    Public key SHA-256 e4fde68fe770a7b9992e1f7bd6333db05170d046b80d090cb00eb034aa049a59
    Brand
    SafePal
    Addresses
    154.86.119.115 · United Kingdom · AS197574 EXPRESSHOST ExpressHost Ltd
    31.59.175.142 · Hong Kong · AS56971 AS56971 CGI GLOBAL LIMITED
    87.232.123.231 · United Kingdom · AS198550 nodehost-as NODE HOST LIMITED
    Domain
    eng-safepal.org
    Registered
    2026-10-28 · Key-Systems GmbH
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 01:16 UTC

    Suggest a correction

  12. safepal.im US · AS396982 · Google LLC
    ListedGoogle CloudListed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    safepal.im
    First seen
    2026-10-28 15:11 UTC
    First published
    2026-10-28 15:12 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 15:21 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-10-28 14:10 UTC to 2027-01-26 14:10 UTC
    Logged 2026-10-28 15:09 UTC in IPng Networks Gouda2027h1, entry 249,276,663
    SHA-256 072ea41502f5f2ea25e7e02934250b4b4ccedb5ea2b7026f2e93649d5352002a
    Public key SHA-256 c1909ab6c9bb403c9fadb8b6e693fba53b7c074c2ea33b5ce97009def3ff1a67
    Brand
    SafePal
    Addresses
    34.130.222.18 · United States · AS396982 GOOGLE-CLOUD-PLATFORM - Google LLC · Google Cloud (cloud provider)
    Google Cloud
    Google Cloud (34.130.222.18): a cloud provider. It rents servers and addresses to its customers.
    Domain
    safepal.im
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 17:09 UTC

    Suggest a correction

  13. www.safepal.im US · AS396982 · Google LLC
    ListedGoogle CloudUnder safepal.im, listed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.safepal.im
    First seen
    2026-10-28 15:11 UTC
    First published
    2026-10-28 15:12 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 15:21 UTC
    Listed
    MetaMask, listing safepal.im and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-10-28 14:10 UTC to 2027-01-26 14:10 UTC
    Logged 2026-10-28 15:09 UTC in IPng Networks Gouda2027h1, entry 249,276,663
    SHA-256 072ea41502f5f2ea25e7e02934250b4b4ccedb5ea2b7026f2e93649d5352002a
    Public key SHA-256 c1909ab6c9bb403c9fadb8b6e693fba53b7c074c2ea33b5ce97009def3ff1a67
    Brand
    SafePal
    Addresses
    34.130.222.18 · United States · AS396982 GOOGLE-CLOUD-PLATFORM - Google LLC · Google Cloud (cloud provider)
    Google Cloud
    Google Cloud (34.130.222.18): a cloud provider. It rents servers and addresses to its customers.
    Domain
    safepal.im
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 17:09 UTC

    Suggest a correction

  14. comwww.wallet-safepal.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ReportedParking page · ParkingCrew (Team Internet)Under wallet-safepal.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 11 mo ago
    DetailsHide
    Hostname
    comwww.wallet-safepal.com
    First seen
    2026-10-28 09:46 UTC
    First published
    2026-10-28 10:00 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 10:08 UTC
    Reported
    PhishDestroy, listing wallet-safepal.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-28 08:43 UTC to 2027-01-26 08:43 UTC
    Logged 2026-10-28 09:42 UTC in DigiCert Wyvern2027h1, entry 332,282,658
    SHA-256 15c377e963ae1768926b07f41ae3b3ba06381b0a6bb0d3938b1d0204b07631f3
    Public key SHA-256 89a6d0d2e29dad147b3ee30d8e8234888a04f5fc890737dc2bd96971e0c87895
    PhishDestroy
    Brand
    SafePal
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    wallet-safepal.com
    Registered
    2025-12-23 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 22:18 UTC

    Suggest a correction

  15. www.official-safepal.io GB · AS197574 · EXPRESSHOST ExpressHost Ltd
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 8 d ago
    DetailsHide
    Hostname
    www.official-safepal.io
    First seen
    2026-10-28 08:42 UTC
    First published
    2026-10-28 08:43 UTC
    DNS
    Not resolving since 2026-11-04 · checked 2026-11-05 09:07 UTC
    Checks
    Overdue since 2026-11-04 09:07 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 154.86.119.151.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 154.86.119.151
    Certificate
    Issued by YR1
    Valid 2026-10-28 07:38 UTC to 2027-01-26 07:38 UTC
    Logged 2026-10-28 08:37 UTC in Google PlumbersArms2027h1, entry 485,986,425
    SHA-256 2eaf5b92bb0142a40acc5da26219e1a0d2f5698613a887fc4bc13f116362c82e
    Public key SHA-256 d3eaf6eb91e862805c2353f724c9d6b6e179c821e7bf1978af44cc4ebe014f1e
    Brand
    SafePal
    Addresses
    154.86.119.151 · United Kingdom · AS197574 EXPRESSHOST ExpressHost Ltd
    Domain
    official-safepal.io
    Registered
    2026-10-28 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 13:27 UTC

    Suggest a correction

  16. official-safepal.io GB · AS197574 · EXPRESSHOST ExpressHost Ltd
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 8 d ago
    DetailsHide
    Hostname
    official-safepal.io
    First seen
    2026-10-28 08:42 UTC
    First published
    2026-10-28 08:43 UTC
    DNS
    Not resolving since 2026-11-04 · checked 2026-11-05 09:05 UTC
    Checks
    Overdue since 2026-11-04 09:04 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 154.86.119.151.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 154.86.119.151
    Certificate
    Issued by YR1
    Valid 2026-10-28 07:38 UTC to 2027-01-26 07:38 UTC
    Logged 2026-10-28 08:37 UTC in Google PlumbersArms2027h1, entry 485,986,425
    SHA-256 2eaf5b92bb0142a40acc5da26219e1a0d2f5698613a887fc4bc13f116362c82e
    Public key SHA-256 d3eaf6eb91e862805c2353f724c9d6b6e179c821e7bf1978af44cc4ebe014f1e
    Brand
    SafePal
    Addresses
    154.86.119.151 · United Kingdom · AS197574 EXPRESSHOST ExpressHost Ltd
    Domain
    official-safepal.io
    Registered
    2026-10-28 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 13:27 UTC

    Suggest a correction

  17. www.safepalwallet.support SG · AS63949 · Akamai Connected Cloud3 addresses
    Phishing hostAkamai LinodeAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    www.safepalwallet.support
    First seen
    2026-10-27 15:43 UTC
    DNS
    Resolves · checked 2026-11-05 09:01 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 172.232.24.161.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 172.232.24.161
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-27 14:39 UTC to 2027-01-25 14:39 UTC
    Logged 2026-10-27 15:38 UTC in Geomys Tuscolo2027h1, entry 372,135,954
    SHA-256 12deac5b6895db8220bb6216ed522590eb285a3aefefc3009bad96659f9f417a
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    Brand
    SafePal
    Addresses
    172.232.24.161 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.232.24.235 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.234.25.42 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (172.232.24.161, 172.232.24.235, 172.234.25.42): a cloud provider. It rents servers and addresses to its customers.
    Domain
    safepalwallet.support
    Registered
    2026-06-19 · NameSilo, LLC
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:32 UTC

    Suggest a correction

  18. safepal.com.se US · AS36352 · HostPapa
    ListedColoCrossingListed by MetaMask
    DetailsHide
    Hostname
    safepal.com.se
    First seen
    2026-10-27 14:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:02 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. We matched its certificate name
    3. Latest DNS check
    Certificate
    Logged in IPng Networks Gouda2027h1, entry 238,614,500
    SHA-256 f53ef292900d559bc43fb7b376c9252fefd86f87fd56dafb385ffc44cfefc665
    Brand
    SafePal
    Addresses
    216.144.233.226 · United States · AS36352 AS-COLOCROSSING - HostPapa · ColoCrossing (shared hosting)
    ColoCrossing
    ColoCrossing (216.144.233.226): shared web hosting and domain registration. One address typically serves many customer sites.

    Suggest a correction

  19. safepal-cn.gr.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    safepal-cn.gr.com
    First seen
    2026-10-27 05:37 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:02 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. We matched the new listing
    3. Latest DNS check
    Brand
    SafePal
    Addresses
    104.21.93.83 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.207.157 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::ac43:cf9d
    2606:4700:3033::6815:5d53
    Cloudflare
    Cloudflare (104.21.93.83, 172.67.207.157): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  20. safepalwallet.hu US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX presentSPF ~allDMARC reject
    DetailsHide
    Hostname
    safepalwallet.hu
    First seen
    2026-10-27 05:37 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:04 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. We matched the new listing
    3. Latest DNS check
    Brand
    SafePal
    Addresses
    104.21.32.182 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.153.172 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::6815:20b6
    2606:4700:3032::ac43:99ac
    Cloudflare
    Cloudflare (104.21.32.182, 172.67.153.172): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    safepalwallet.hu
    MX
    Receives mail at mail.safepalwallet.hu
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 08:28 UTC

    Suggest a correction

  21. www.safepal.kiev.ua UA · AS200000 · Ukraine-AS Hosting Ukraine …
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missingRegistered 3 y ago
    DetailsHide
    Hostname
    www.safepal.kiev.ua
    First seen
    2026-10-26 23:06 UTC
    DNS
    Resolves · checked 2026-11-05 09:04 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 91.206.200.104.
    1. Phishing-host list fetched with the address
    2. Resolved to 91.206.200.104
    3. Latest DNS check
    Certificate
    Logged in DigiCert Sphinx2027h1, entry 280,852,078
    SHA-256 42bff50115cdc324e3b3180cf6ad08b12db62870ab417df533d52c1b3b9873e8
    Brand
    SafePal
    Addresses
    91.206.200.104 · Ukraine · AS200000 Ukraine-AS Hosting Ukraine LTD
    Domain
    safepal.kiev.ua
    Registered
    2023-09-25 · Hosting Ukraine LLC
    MX
    Receives mail at mx.ukraine.com.ua
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:25 UTC

    Suggest a correction

  22. safepal.kiev.ua UA · AS200000 · Ukraine-AS Hosting Ukraine …
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missingRegistered 3 y ago
    DetailsHide
    Hostname
    safepal.kiev.ua
    First seen
    2026-10-26 23:06 UTC
    DNS
    Resolves · checked 2026-11-05 09:04 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 91.206.200.104.
    1. Phishing-host list fetched with the address
    2. Resolved to 91.206.200.104
    3. Latest DNS check
    Certificate
    Logged in DigiCert Sphinx2027h1, entry 280,852,078
    SHA-256 42bff50115cdc324e3b3180cf6ad08b12db62870ab417df533d52c1b3b9873e8
    Brand
    SafePal
    Addresses
    91.206.200.104 · Ukraine · AS200000 Ukraine-AS Hosting Ukraine LTD
    Domain
    safepal.kiev.ua
    Registered
    2023-09-25 · Hosting Ukraine LLC
    MX
    Receives mail at mx.ukraine.com.ua
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:25 UTC

    Suggest a correction

  23. sf.wallet-safepal.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ReportedParking page · ParkingCrew (Team Internet)Under wallet-safepal.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 11 mo ago
    DetailsHide
    Hostname
    sf.wallet-safepal.com
    First seen
    2026-10-26 09:56 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:01 UTC
    Reported
    PhishDestroy, listing wallet-safepal.com and the names under it
    1. Observed in the PhishDestroy feed
    2. We matched its certificate name
    3. Latest DNS check
    Certificate
    Logged in DigiCert Sphinx2027h1, entry 277,459,446
    SHA-256 dcab4943634b21808a412e0db9920b13805d5fa52ee87b20d29247b46c880d38
    PhishDestroy
    Brand
    SafePal
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    wallet-safepal.com
    Registered
    2025-12-23 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 22:18 UTC

    Suggest a correction

How certificate findings are selected

Reported: PhishTank or PhishDestroy reports the hostname as phishing. Listed: CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists it, in the source's own category. Phishing host: the name resolves to an address on DomainSpoof's phishing-host list, the addresses that hosted confirmed phishing in the last 48 hours. Spamhaus DROP: it resolves to an address on the Spamhaus DROP list. Same certificate: it shares a certificate with a finding and has listing evidence of its own, a report or listing by a source or its own Spamhaus DROP address.

DomainSpoof reads public certificate logs and the feeds on Sources every hour. A hostname matches SafePal when a label carries the brand's name, by the rules on How it works. A lookalike spelling of an official domain matches too. A hostname with two kinds of finding is one row. Details shows the recorded checks, the source's claim and the check times available. How it works · Sources

More brands in Crypto & web3

All brands →