keetasnetworkchecks[.]xyz

Analysis indicates that the domain keetasnetworkchecks.xyz was registered on 18 September 2025 through NiceNIC International Group Co., Limited. The authoritative name servers are edna.ns.cloudflare.com and elijah.ns.cloudflare.com, pointing to the Cloudflare network (AS13335). DNS resolution maps the domain to IP 104.21.78.134, an address hosted in the United States. No TLS certificate is presented for the host, meaning HTTPS connections would be unencrypted or would fallback to HTTP.

The site’s only observed HTML element is the page title “Nur einen Moment…”, which offers no indication of the intended victim brand or lure. VirusTotal scans have recorded detections by five of ninety‑five security vendors, and the domain is listed on a single external blocklist. PhishDestroy has already taken the domain offline, and current network probes confirm that the service is no longer reachable. The combination of recent registration, Cloudflare front‑end, lack of SSL, and multiple vendor detections aligns with typical infrastructure used for generic phishing campaigns.

At this time, there is no publicly available evidence describing the exact phishing payload, credential‑stealing page, or targeted organization. Consequently, analysts should treat any future resolution of keetasnetworkchecks.xyz as suspicious and block it at perimeter defenses. Continuous monitoring of the IP address 104.21.78.134 for re‑use, as well as periodic re‑query of threat‑intel feeds, is advised. Organizations employing URL filtering should ensure that the domain is added to deny lists, and incident‑response teams should be prepared to investigate any logs that reference this host.