kta-collect[.]xyz

Analysis as of July 24 2026 indicates that the domain kta-collect.xyz is currently offline but exhibits multiple indicators of malicious activity. The domain resolves to IP address 104.21.1.33, which is owned by Cloudflare, Inc. (AS13335) and is located in the United States. Registration data shows the domain was created on February 21 2026 through NiceNIC International Group Co., Limited, and it uses Cloudflare DNS resolvers connie.ns.cloudflare.com and rocco.ns.cloudflare.com. The TLS certificate presented is issued by Google Trust Services under the WE1 label, confirming that HTTPS is available but does not guarantee legitimacy. The public page title retrieved before takedown reads “Keeta | Where Networks Connect,” a phrase that does not correspond to any known legitimate service and has not been further examined.

VirusTotal reports that 8 of 93 scanning engines have flagged the domain, reflecting a moderate detection rate. Independent blocking services including PhishDestroy, MetaMask, ScamSniffer, and SEAL have listed the domain, and it appears on four additional security blocklists. Detected technologies include Cloudflare’s edge network and HTTP/3 support, both common in benign services but also frequently leveraged by threat actors to obscure origin. Collectively, the registration age, short lifespan, detection by multiple anti‑phishing vendors, and presence on blocklists suggest the domain is being used for generic phishing campaigns, despite the lack of a publicly visible payload.

Because the site is offline, content analysis is limited; the exact lure, credential‑stealing form, or targeted brand cannot be confirmed at this time. Defenders should continue to block kta-collect.xyz at DNS and proxy layers, monitor for any re‑activation of the domain, and correlate any future traffic with known malicious IP 104.21.1.33.