keplr[.]live

Analysis of the domain keplr.live indicates it is an active phishing site impersonating the Keplr cryptocurrency wallet service. The domain was registered on July 20, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and currently resolves to the IP address 172.67.154.195. Infrastructure analysis reveals the domain is hosted behind Cloudflare, utilizing nameservers crystal.ns.cloudflare.com and milan.ns.cloudflare.com. As of July 26, 2026, the domain appears on one security blocklist and is actively blocked by PhishDestroy, though it remains unflagged by any of the 91 vendors that scanned it on VirusTotal. The absence of detections in VirusTotal does not confirm the domain's safety, as phishing sites often evade initial scans.

The domain's registration age (six days at the time of reporting) aligns with typical phishing campaign timelines, where newly registered domains are frequently used to bypass reputation-based filters. The use of Cloudflare nameservers and hosting is consistent with threat actors leveraging CDN services to obscure origin infrastructure and evade takedowns. No specific details about the page content, such as login forms or branding elements, have been confirmed in the available data. However, the domain name strongly suggests an intent to deceive users of the legitimate Keplr wallet service, likely aiming to harvest credentials or private keys. Defenders should treat this domain as high-risk due to its active status, recent registration, and association with a known cryptocurrency service.

Network-level blocking is recommended, particularly for organizations handling cryptocurrency transactions or wallet-related services. Monitoring for related domains with similar naming patterns (e.g., typosquatting variations of 'keplr') may help identify additional threats. Further investigation into the IP address 172.67.154.195 is advised to determine if it hosts other malicious domains.