keyport[.]pages[.]dev

This domain, keyport.pages.dev, is flagged as an active credential theft site specifically designed to impersonate Keyport, a legitimate password management service for individuals, families, and businesses. Analysis indicates the infrastructure is being used to harvest login credentials, likely through fake login portals or account verification prompts that closely resemble the authentic Keyport interface. The domain remains operational and has not yet been widely detected by security vendors. Infrastructure analysis reveals the domain was registered through Cloudflare Pages on March 27, 2026, and currently resolves to the IP address 188.114.96.3, geolocated to Canada under Cloudflare, Inc. Despite its recent creation date, the domain appears on one security blocklist and has been flagged by zero of 95 VirusTotal vendors as of the latest scan. The SSL certificate is issued by Google Trust Services (WE1), providing a false sense of legitimacy to potential victims. The page title explicitly mimics the legitimate Keyport brand: 'Keyport - Password Manager for Individuals, Families, and Businesses.' Current status shows the domain remains active and accessible, posing an ongoing risk to users who may mistake it for the legitimate Keyport service. Security teams are advised to block the domain and IP address 188.114.96.3 at the network perimeter. Users should verify the authenticity of any Keyport-related communications by checking the official domain and SSL certificate details. Organizations should monitor for credential reuse attempts from harvested accounts and implement multi-factor authentication as a mitigation measure. The domain's use of Cloudflare infrastructure may complicate takedown efforts, requiring coordination with the hosting provider.