keepkeydesktopwallet[.]app

This domain, keepkeydesktopwallet.app, is identified as a high-risk crypto drainer phishing site designed to impersonate the legitimate KeepKey hardware wallet software. Analysis indicates its primary threat involves stealing cryptocurrency wallet credentials and draining funds from connected wallets, a tactic commonly associated with malicious actors targeting digital asset holders. The domain is currently offline, but prior activity suggests it was actively used in fraudulent campaigns to deceive users into disclosing sensitive information or executing unauthorized transactions. Infrastructure analysis reveals multiple technical indicators supporting its malicious classification. The domain was registered through NiceNIC International Group Co., Limited on January 09, 2026, an unusually future-dated creation that may indicate an attempt to evade detection or scrutiny. It resolves to the IP address 216.198.79.1, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509) in the United States. Security vendors flagged the domain in 17 out of 95 VirusTotal scans, while Google Safe Browsing explicitly labeled it as a phishing site. Additionally, the domain appears on one security blocklist and was blocked by PhishDestroy, further corroborating its fraudulent nature. The SSL certificate, issued by Let's Encrypt (R12), does not mitigate the risk, as malicious actors frequently leverage free certificates to lend a false sense of legitimacy to phishing sites. The domain is currently offline, reducing immediate exposure to end users. However, the infrastructure and registration details suggest potential for reactivation or reuse in future campaigns. Organizations and individuals are advised to block the domain and its associated IP address (216.198.79.1) at the network level to prevent accidental access. Users who may have interacted with this domain should immediately revoke any wallet authorizations, transfer assets to a new wallet, and monitor accounts for unauthorized transactions. Security teams are encouraged to treat this domain as a confirmed threat and include it in threat intelligence feeds for proactive defense measures. Given the high-risk nature of crypto drainers, vigilance and rapid response are critical to mitigating financial losses.