kepdex[.]io

This domain, kepdex.io, is assessed as an elevated-risk brand impersonation site targeting Ethereum users. Infrastructure analysis reveals the domain was registered on March 3, 2026, through NiceNIC International Group Co., Limited and is currently offline. The page title, 'Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | KepDex,' explicitly mimics a cryptocurrency exchange, aligning with the reported scam type of brand impersonation. The domain resolves to IP 172.67.154.204, hosted on Cloudflare’s network (AS13335) in the US, and uses Cloudflare nameservers (isabel.ns.cloudflare.com, moura.ns.cloudflare.com). SSL certification is provided by Google Trust Services (WE1), a common feature in both legitimate and malicious sites.

Security vendor detections indicate 14 of 94 engines on VirusTotal flagged the domain, and it appears on one security blocklist, specifically PhishDestroy. Detected technologies include Chart.js, jsDelivr, Facebook Pixel, cdnjs, and Cloudflare Browser Insights, which are not inherently malicious but are frequently used in phishing infrastructure to enhance functionality and tracking. The Gridinsoft trust score of 0/100 further supports the domain’s malicious classification. Defenders should treat this domain as confirmed malicious infrastructure.

While the site is currently offline, historical DNS and WHOIS records should be preserved for forensic analysis. Network-level blocks at the IP and domain level are recommended, and security teams should monitor for re-registration or re-emergence under similar names. Given the explicit targeting of Ethereum users, alerting cryptocurrency-focused security communities and exchange platforms may help mitigate further risk. No evidence of a specific phishing kit or payload is present in the available data, so further analysis of archived content is advised if available.