eligibility[.]keeta-drop[.]xyz

The domain eligibility.keeta-drop.xyz was provisioned on September 10, 2025 through NiceNIC International Group Co., Limited and is presently taken offline. DNS resolution points to the IP address 172.67.191.132, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The domain is served by the Cloudflare nameservers beau.ns.cloudflare.com and val.ns.cloudflare.com, indicating use of a widely available CDN and DDoS mitigation service. No SSL/TLS certificate is presented, meaning the site does not support encrypted HTTPS connections.

The only observable HTTP content is a page titled "Just a moment...", which provides no functional context and suggests a placeholder page often employed in temporary or staging sites. Reputation metrics are uniformly low: Gridinsoft assigns a trust score of 0 out of 100, while Scamadviser records a score of 20 out of 100, reflecting a strong likelihood of malicious intent. VirusTotal analysis shows that four of ninety‑five scanning engines have flagged the domain as malicious, and it appears on one external security blocklist. Additionally, the PhishDestroy service has listed the domain as blocked.

Collectively, these data points indicate that eligibility.keeta-drop.xyz has been used in a phishing campaign targeting users with a generic lure, although the exact luring technique or credential‑harvesting page has not been captured. Defenders should treat the domain as hostile, enforce network‑level blocks on both the hostname and its resolver IP, and monitor for any re‑registration or re‑activation attempts. Given the Cloudflare hosting, traffic may be proxied through additional IPs; correlation of future DNS queries to the same ASN can assist in early detection. Continuous threat‑intel feeds should be consulted for any updates to the domain's status or associated indicators of compromise.