keeta[.]web[.]id

This domain, keeta.web.id, is currently under investigation for credential harvesting activities targeting Indonesian-language users. Analysis indicates the site likely mimics legitimate login portals to capture authentication credentials, payment details, or personal data through fraudulent forms. The infrastructure appears tailored to regional targets, given its Indonesian registration and hosting context. Infrastructure analysis reveals the domain was registered on March 24, 2026, through PT Jagoan Hosting Indonesia, with an active resolution to 104.21.57.172. The SSL certificate is issued by Let's Encrypt, providing a false sense of security. As of the latest scan, the domain shows 0 detections across 95 security engines on VirusTotal, indicating it remains undetected by most automated systems. No blocklist entries have been recorded yet, suggesting the operation is either new or employs evasion techniques. Users who have visited keeta.web.id or entered credentials on the site should immediately revoke any submitted information, particularly login details for financial or email accounts. Monitor associated accounts for unauthorized activity and enable multi-factor authentication where available. Network administrators should consider blocking the domain and its resolving IP at the perimeter. Given the domain's recent creation and lack of detections, this threat may escalate; continuous monitoring of related infrastructure is recommended.