karakeep[.]3773774[.]xyz

Analysis as of July 24 2026 indicates that the domain karakeep.3773774.xyz is actively leveraged in a high‑risk phishing campaign. The domain was registered on February 21 2026 through Spaceship, Inc. and resolves to the Cloudflare edge address 172.67.147.96, which is associated with AS13335 Cloudflare, Inc. in the United States. DNS resolution is served by harmony.ns.cloudflare.com and terry.ns.cloudflare.com. HTTPS connections present a Google Trust Services / WE1 certificate, but HTTP requests return status code 525, suggesting an SSL handshake failure at the origin server.

The site’s page title is “Karakeep”, but no further content has been disclosed. Security telemetry shows the domain appears on three blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis reports three of ninety‑three scanners flagging the domain, reinforcing the malicious classification. Infrastructure fingerprinting reveals a stack comprising Node.js, Nginx, OpenResty, React, Next.js, HSTS, and Webpack, indicating a modern web application framework that may be used to host credential‑stealing pages.

Gridinsoft assigns a trust score of 0 out of 100. While the exact phishing lure and targeted brand are not yet identified, the combination of recent registration, active blocklist entries, low trust score, and confirmed detection by multiple vendors confirms a credible threat. Defenders should add karakeep.3773774.xyz to URL filtering policies, block the associated IP range, monitor for related DNS queries, and enforce strict TLS inspection to capture the underlying payload. Continuous re‑evaluation is advised as additional indicators may emerge.