keystonevaleunion[.]com

On 23 July 2026 the domain keystonevaleunion.com was observed serving HTTP responses with status code 200. The site presents a page title identical to the domain name, and the TLS certificate is issued by Let’s Encrypt (CN=E8), indicating use of a free certificate authority. Passive DNS shows the domain resolves to the IPv4 address 198.251.89.229, which is hosted in the United States and belongs to ASN 53667, operated by FranTech Solutions. Registration records indicate the domain was created on 21 February 2026 through Global Domain Group LLC and is delegated to the authoritative name servers ns111.my-control-panel.com and ns112.my-control-panel.com.

Technical fingerprinting detected the presence of Tailwind CSS, LiteSpeed web server, Alpine.js, Smartsupp live‑chat widget, jsDelivr CDN and HTTP/3 support, suggesting a modern web stack but providing no indication of malicious functionality. VirusTotal has flagged the domain on 15 of 93 scanned security vendors, and the domain appears on a single public phishing blocklist, where it has been added to the PhishDestroy blocklist. The available intelligence does not reveal the specific brand or service being spoofed, nor does it contain samples of credential‑stealing pages or malicious payloads.

Consequently, the confidence that the domain is being used for generic phishing remains high, but the exact lure and victim profile cannot be confirmed without content analysis. Defenders should block network connections to 198.251.89.229, add keystonevaleunion.com to local URL filtering and email security policies, and monitor for any outbound traffic that may indicate successful credential capture. Continuous re‑scanning with sandbox environments and periodic VirusTotal checks are recommended to capture any evolution of the payload or additional vendor detections.