distributions-keeta[.]org

This domain, distributions-keeta.org, is identified as a high-risk crypto drainer phishing infrastructure designed to compromise digital wallet credentials and siphon cryptocurrency assets. Analysis indicates the absence of legitimate brand impersonation, suggesting a generic but highly effective drainer kit deployment. The domain exhibits no affiliation with recognized financial or blockchain entities, operating as a standalone malicious endpoint to execute unauthorized transactions upon user interaction. Infrastructure analysis reveals critical technical indicators: the domain resolves to the IP address 172.67.215.183 and was registered on June 09, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. Detection metrics confirm its malicious classification, with 17 out of 95 security vendors flagging the domain on VirusTotal. The domain appears on four independent security blocklists and is referenced in two AlienVault OTX threat intelligence pulses. Gridinsoft assigns a trust score of 0/100, reinforcing its high-risk designation. No entries were found in Google Safe Browsing at the time of assessment, though this does not mitigate the confirmed malicious activity. The domain is currently offline, likely due to takedown actions or infrastructure suspension. Despite its inactive status, residual risk persists for users who may have interacted with the domain prior to its deactivation. Historical DNS records and cached malicious payloads could still pose a threat if accessed via local system artifacts or proxy services. Users are advised to verify wallet integrity, revoke any suspicious token approvals, and monitor transaction histories for unauthorized activity. Organizations should update blocklists to include this domain and its associated IP to prevent future exposure.