keypriv[.]eu[.]com

The domain keypriv.eu.com was registered on 13 March 2026 and points to the IP address 172.67.134.214, which belongs to AS13335 Cloudflare, Inc. in the United States. The site served HTTP only; no SSL certificate was observed, indicating that traffic was unencrypted. The page title returned by the web server is “Hyper liquid”, but no further content has been harvested. Security tooling has flagged the domain as a generic phishing vector: PhishDestroy, MetaMask, and SEAL have listed it, and it appears on three external blocklists.

VirusTotal submitted the URL to 94 AV engines; none reported a detection, a result that does not imply safety given the limited visibility of the payload. As of the report date (22 July 2026) the host is reported offline, and the risk rating remains “under investigation”. The available evidence confirms the infrastructure is tied to a Cloudflare fronting service, a common choice for fast‑flux or disposable phishing sites.

Uncertainty remains around the exact phishing campaign, target victims, and whether additional domains share the same origin IP. Defenders should add keypriv.eu.com to DNS and URL filtering rules, monitor for new sub‑domains or IPs associated with AS13335 that exhibit similar HTTP‑only behavior, and treat any future resolution to 172.67.134.214 as suspicious until a thorough content analysis is performed. Continued observation of blocklist activity and periodic re‑scanning with multi‑engine services is recommended to capture any emerging malicious payloads.