Fake Keplr Wallet download kit (eng-keplr[.]com, web-keplr[.]com, keplr-station[.]com, keplr[.]to) steals recovery phrases via v1techdomainsec[.]shop

• Scam type: Phishing
• Project or site name: Keplr Wallet (impersonated)
• Incident date: 2026-10-07
• Reported: 2026-11-05
• Last updated: 2026-11-05

A fake Keplr Wallet download kit is stealing wallet recovery phrases and private keys. Its cloned pages are titled "Get Keplr Wallet | Extension and Mobile App". Keplr is only the brand being imitated and is not involved: none of the domains in this report belong to Keplr, whose real site is keplr[.]app. Infrastructure: The entry domains eng-keplr[.]com, web-keplr[.]com and keplr-station[.]com redirect visitors, with a click_id tracking parameter, to rotating landing pages. Public urlscan.io scans from 7 Oct to 5 Nov 2026 record those redirects landing on keplr-8ca[.]pages[.]dev,…