keitarosofts[.]com

This domain, keitarosofts.com, is identified as a high-risk phishing site masquerading as a source for free game cheats and modifications. Analysis of the page title, 'Free Cheats Download | KEITAROSOFTS,' indicates an attempt to lure victims—primarily gamers—into downloading malicious software or disclosing credentials under false pretenses. No explicit brand impersonation is observed, but the content aligns with known phishing tactics targeting gaming communities, often associated with credential theft, malware distribution, or account takeovers. The site does not appear to deploy a known crypto drainer kit, though the presence of Node.js and Vue.js suggests a dynamic front-end designed to evade detection or adapt to user interactions. Infrastructure analysis reveals the domain was registered on June 7, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently abused for malicious campaigns. It resolves to the IP address 104.21.72.230, a Cloudflare-protected endpoint leveraging HTTP/3 and Cloudflare Browser Insights for performance and obfuscation. The domain is flagged by 15 out of 95 security vendors on VirusTotal, with detections spanning phishing, malware, and fraud categories. It appears on five security blocklists, including PhishDestroy, MalwareFilter, OISD, Hagezi, and InversionDNS, and is referenced in four AlienVault OTX threat intelligence pulses. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its automation and free availability. No Google Safe Browsing (GSB) status is provided, but the blocklist presence and vendor detections confirm its malicious classification. As of the latest assessment, keitarosofts.com has been taken offline, likely due to enforcement actions by hosting providers, registrars, or security teams. However, the residual risk remains elevated due to the domain's recent creation, its appearance in multiple threat intelligence feeds, and the transient nature of such campaigns. Organizations and individuals are advised to block the domain and its associated IP (104.21.72.230) at the network level, and to monitor for related indicators, including subdomains or newly registered lookalike domains. End-users should be cautioned against downloading software from unverified sources, particularly those offering cheats, cracks, or other illicit modifications. Security teams are encouraged to correlate this domain with internal logs for signs of compromise, such as connections to the IP or downloads of files linked to the site.