overview-keeta[.]pro

Overview-keeta.pro was registered on March 03, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the Cloudflare IP address 172.67.133.223, ASN 13335 in the United States. The domain uses a Let's Encrypt certificate issued under the E7 profile and serves content over HTTP/3 behind Cloudflare’s edge network. An HTTP 403 response is returned, indicating the site is currently taken offline. The page title reported by passive monitoring is “Keeta | Where Networks Connect”, which aligns with the declared scam type of Wallet/Seed Phishing. The threat actor targets the “across” brand, as indicated by the “Impersonates: across” field, and the campaign is classified as brand impersonation.

Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reflecting extreme malicious intent. VirusTotal analysis shows that 3 of 94 scanned security vendors flagged the domain, and the domain appears on three external blocklists. Additional blocking services, including PhishDestroy, MetaMask, and SEAL, have listed the domain as malicious. The nameservers terin.ns.cloudflare.com and holly.ns.cloudflare.com confirm the use of Cloudflare DNS.

While the site is presently inaccessible, the combination of low trust score, vendor detections, blocklist presence, and the wallet/seed phishing classification indicates a high likelihood of credential or private‑key harvesting attempts. Defenders should continue to block the domain at network perimeter devices, update URL filtering rules, and monitor for any re‑activation of the domain. Incident response teams should also consider correlating logs for connections to 172.67.133.223 and review any attempted interactions with the “across” brand that reference seed phrases or wallet credentials. Because the domain is offline, further forensic analysis of the hosted content is limited; however, the existing indicators warrant a proactive defensive posture.