leapwallet[.]zone

Analysis indicates the domain leapwallet.zone is an active crypto drainer phishing site targeting users of the Keplr wallet, as evidenced by the page title 'Keplr' and classification in threat intelligence feeds. Registered on February 21, 2026, through NiceNIC International Group Co., Limited, the domain resolves to Cloudflare IP 172.67.129.237 (AS13335, United States) and is protected by Cloudflare nameservers (crystal.ns.cloudflare.com, milan.ns.cloudflare.com). The site returns an HTTP 200 status, suggesting a live, functional phishing page. SSL certification is provided by Google Trust Services (WE1), a common feature of both legitimate and malicious sites leveraging Cloudflare's infrastructure. Three of 93 security vendors on VirusTotal have flagged leapwallet.zone, a detection rate consistent with early-stage or evasive phishing campaigns.

The domain appears on one security blocklist and is blocked by PhishDestroy, further corroborating its malicious classification. Gridinsoft assigns a trust score of 0/100, reinforcing the high-risk assessment. Technologies detected include PHP and HTTP/3, which are frequently used in phishing kits for dynamic content delivery and performance optimization. Infrastructure analysis reveals no clear ties to a specific phishing kit or broader campaign beyond the crypto drainer classification.

The use of Cloudflare obscures direct hosting details, a common tactic to delay takedowns. Defenders should treat this domain as an active threat, prioritizing blocking at DNS, proxy, and endpoint levels. Monitoring for associated IP changes or newly registered lookalike domains (e.g., variations of 'leapwallet') is recommended, as threat actors often rotate infrastructure. No evidence links this domain to other known scam clusters at this time, but continued tracking of nameserver, registrar, and SSL certificate patterns may reveal further connections.