keplr[.]zone

The domain keplr.zone has been assessed as presenting an elevated risk level for credential theft. Analysis indicates that the domain was likely used to trick users into revealing sensitive information such as login credentials, potentially leading to unauthorized access and data compromise.

This domain is flagged as a credential theft threat by 12 out of 95 security vendors on VirusTotal. It was registered through NiceNIC International Group Co., Limited and created on February 21, 2026. The domain resolves to the IP address 104.21.83.22, which is located in the United States and is associated with AS13335 Cloudflare, Inc. The domain appears on one security blocklist and has been taken offline, suggesting that it was actively used for malicious purposes before being shut down. The SSL certificate used was WE1, which may have added a false sense of security to unsuspecting users. The page title was found to be 'Keplr', which could be an attempt to impersonate the legitimate Keplr brand.

To mitigate the risks associated with this domain, users should avoid visiting any similar or related web pages and should immediately change passwords for any accounts that may have been compromised. Organizations should update their security policies to block access to this domain and similar sites, and conduct regular security awareness training to help employees recognize and avoid credential theft attempts. Additionally, monitoring for any unauthorized access or suspicious activity in user accounts is crucial to detect and respond to potential breaches.