keplrs[.]vip

Analysis of the domain keplrs.vip indicates it was actively involved in crypto wallet phishing operations prior to being taken offline. The domain, created on February 21, 2026, resolved to IP address 172.67.198.37, hosted on Cloudflare's infrastructure (AS13335) in the United States. Nameservers elisabeth.ns.cloudflare.com and brad.ns.cloudflare.com were in use, and the site employed Cloudflare technologies, including HTTP/3, but no SSL certificate was detected. At the time of assessment, the domain returned a 522 connection timeout error, with the page title explicitly stating 'keplrs.vip | 522: Connection timed out,' confirming its offline status.

Detection data from security vendors is limited but indicative of malicious intent. Two out of 93 vendors on VirusTotal flagged the domain as malicious, while PhishDestroy explicitly blocked it. The domain appears on one security blocklist, reinforcing its classification as a phishing threat. No additional context regarding the specific phishing kit, targeted brand, or exact user interaction mechanisms is available, though the domain name suggests an attempt to impersonate the legitimate Keplr crypto wallet service.

Defenders should treat this domain as a confirmed phishing indicator. Network-level blocking is recommended for the domain and its associated IP (172.67.198.37). Given the use of Cloudflare, monitoring for re-emergence under new subdomains or similar naming conventions is advised. No further content analysis is possible due to the domain's offline status, but historical logs should be reviewed for connections to this domain or IP to identify potential prior compromises.