reward-keeta[.]icu

Analysis of reward-keeta.icu indicates a phishing domain targeting users with a fraudulent airdrop scheme, as classified in available threat intelligence. The domain was registered on March 5, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently offline, returning an HTTP 403 status. Infrastructure analysis reveals it was hosted behind Cloudflare (AS13335) at IP 188.114.97.3, with nameservers kelly.ns.cloudflare.com and fred.ns.cloudflare.com. The SSL certificate was issued by Let's Encrypt (serial E8), a common choice for both legitimate and malicious sites.

Detection data shows the domain appears on three security blocklists, and four of 94 security vendors on VirusTotal flagged it as malicious. MetaMask, PhishDestroy, and SEAL have explicitly blocked access to this domain. The page title, 'Suspected phishing site | Cloudflare,' suggests Cloudflare's automated systems or manual review identified the domain as suspicious, though the exact content or lure used remains unconfirmed. Given the domain's registration details, hosting provider, and detection history, defenders should treat reward-keeta.icu as confirmed phishing infrastructure.

Network-level blocking is recommended, particularly for organizations with exposure to cryptocurrency or airdrop-related activity. While the domain is currently offline, historical DNS and registration data should be preserved for further investigation or takedown actions. No evidence links this domain to a specific cryptocurrency project or brand, so generic airdrop-themed phishing remains the most accurate classification.