drop-keeta[.]xyz

The domain drop-keeta.xyz was registered on December 5, 2025 through NiceNIC International Group Co., Limited and is currently pointed at 172.67.159.211, an address owned by Cloudflare, Inc. (AS13335) and located in the United States. The site resolves to two Cloudflare nameservers, carol.ns.cloudflare.com and marty.ns.cloudflare.com, and does not present an SSL certificate, indicating that any data submitted over HTTPS would be unsecured. The HTTP service has been taken offline, confirming that the site is no longer reachable at the time of analysis. The only visible content captured before takedown was the page title "Nur einen Moment…", which offers no explicit indication of the intended victim brand or the type of credential collection employed.

VirusTotal records show six of ninety‑five security scanners flagging the domain as malicious, providing a modest but notable consensus of suspicious behavior. PhishDestroy has listed the site on its blocklist, and the domain appears on one additional security blocklist, reinforcing the detection by multiple threat‑intel sources. The Gridinsoft trust score of 0 out of 100 further confirms a lack of reputational confidence. No SSL/TLS artifacts exist, and no Safe Browsing, OTX, or Google Transparency data were supplied, leaving those vectors unverified.

Given the combination of a recent registration, Cloudflare hosting, multiple vendor detections, and a blocklist presence, defenders should add drop-keeta.xyz to firewall deny lists, monitor DNS queries for the domain, and ensure endpoint protection solutions are updated to flag any attempted connections. Continuous observation of the IP address 172.67.159.211 is advised, as Cloudflare may host additional malicious payloads under the same infrastructure. In the absence of concrete evidence about the targeted brand, analysts should treat the domain as a generic phishing instrument and maintain heightened vigilance for related activity.