keepassxc[.]io

Analysis of keepassxc.io indicates a confirmed brand impersonation threat targeting KeePassXC, a cross-platform password manager. The domain, registered on October 26, 2025, through NameSilo, LLC, resolves to IP address 91.222.173.30, hosted on AS43641 (SOLLUTIUM EU Sp z.o.o.) in the Netherlands. Infrastructure analysis reveals the domain lacks an SSL certificate, a common red flag for fraudulent sites, and uses nameservers ns1-us.v-sys.org and ns2-us.v-sys.org, which have been associated with other malicious domains in prior threat intelligence reports. The domain is flagged by 14 of 93 security vendors on VirusTotal, including detection by PhishDestroy, and appears on one security blocklist.

AlienVault OTX lists it in a threat intelligence pulse, further corroborating its malicious classification. The page title, 'KeePassXC – Secure, Cross-Platform Password Manager,' directly mimics the legitimate KeePassXC brand, confirming the impersonation scam type. Gridinsoft assigns a trust score of 0/100, reflecting high confidence in its fraudulent nature. As of July 23, 2026, the domain is offline, though defenders should treat its infrastructure as compromised.

The absence of SSL, use of a recently registered domain, and association with a hosting provider linked to prior malicious activity align with known phishing patterns. Organizations should block the domain and IP at the network level, monitor for related indicators of compromise, and alert users to avoid interaction with any future iterations of this campaign. The exact content or functionality of the site remains unanalyzed, but the available evidence strongly supports its classification as a brand impersonation threat.