distribution-keeta[.]network

The domain distribution-keeta.network was registered on February 21, 2026 and is currently listed as taken offline. DNS resolution points to the IP address 104.21.64.1, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site presents the page title "Keeta | Where Networks Connect," but no further content analysis is available. VirusTotal records indicate that a single security vendor out of ninety‑three flagged the domain, suggesting limited detection coverage.

Independent threat‑intelligence feeds have added the domain to five public blocklists, and commercial filtering services including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura have explicitly blocked it. The SSL certificate presented is identified as WE1, confirming that HTTPS is enabled but offering no additional trust signals. The campaign is classified as a wallet/seed phishing operation, targeting users by impersonating a brand across an unspecified scope.

Infrastructure analysis shows reliance on Cloudflare’s CDN, a common tactic for fast‑flux or anonymity. Defenders should update perimeter controls to block both the domain and its associated IP range, enforce TLS inspection to capture the WE1 certificate, and monitor for any reuse of the certificate or similar page titles in future campaigns. Continuous re‑query of VirusTotal and blocklist aggregators is recommended to capture additional detections as the threat actor expands its footprint.