keplrwallet[.]to

keplrwallet.to was registered on March 11 2026 through a registrar listed as the Government of Kingdom of Tonga. DNS resolution points to the Cloudflare address 172.67.186.251, which belongs to AS13335 in the United States. The domain uses Cloudflare name servers megan.ns.cloudflare.com and yew.ns.cloudflare.com, and presents an HTTPS certificate issued by Google Trust Services under the WE1 label, indicating a valid TLS termination despite the malicious intent. Public scans show the page title "Keplr Wallet: Secure Cosmos Wallet for IBC, Staking & DeFi", which aligns with a wallet‑seed phishing campaign targeting users of the Keplr cryptocurrency wallet.

The site appears on three independent security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL. An AlienVault OTX pulse references the domain, and VirusTotal reports 13 of 94 scanners flagging it as malicious. Current HTTP status is offline, confirming that the site is no longer reachable at the time of analysis.

Evidence points to a classic brand‑impersonation technique, but the exact phishing payload and landing page content have not been captured. Defenders should add the domain and its IP to firewall deny lists, monitor for future registrations of similar keplr‑related names, and enforce strict URL filtering for any references to "Keplr Wallet" that resolve to Cloudflare‑hosted IPs. Ongoing threat hunting should include correlation of outbound traffic to 172.67.186.251 with credential‑exfiltration signatures, and threat intel feeds should be updated to reflect the offline status while retaining the indicator for potential re‑use.