keplr-01[.]com

Analysis of keplr-01.com indicates a high-risk brand impersonation domain targeting Keplr, a cryptocurrency wallet service. The domain was registered on September 8, 2025, through Dominet (HK) Limited and resolves to IP 47.76.252.204, hosted on Alibaba's network (AS45102) in Hong Kong. No SSL certificate was detected, increasing the likelihood of unencrypted credential harvesting. The page title 'Exchange Phoenix' suggests an attempt to mimic a cryptocurrency exchange interface, though the exact content and functionality remain unconfirmed due to the domain's current offline status.

Security vendors have flagged this domain as malicious, with 11 out of 95 engines on VirusTotal detecting it as harmful. Google Safe Browsing classifies it as social engineering, and it appears on at least one security blocklist. The domain uses Alibaba's nameservers (ns7.alidns.com, ns8.alidns.com), a common infrastructure choice for phishing campaigns due to its low-cost hosting and rapid provisioning. Gridinsoft assigns a trust score of 0/100, further supporting its classification as malicious.

Defenders should treat this domain as compromised and block it at the DNS and proxy levels. Given its association with Keplr impersonation, organizations handling cryptocurrency or wallet services should monitor for related credential theft attempts. The domain's offline status may indicate takedown efforts or temporary suspension, but historical DNS records should be preserved for forensic analysis. No evidence currently links this domain to a specific phishing kit or broader campaign, though its infrastructure aligns with known patterns of cryptocurrency-related fraud.