Is kety.ma safe?

What the automated checks actually show

The adverse signal here is a saved antivirus observation: one independent antivirus family reported an adverse result, with the label referring to phishing and other frauds (source:antivirus:aggregate). That is a real vendor detection, but it is a single family out of the ecosystems normally consulted, and the saved observation is stale rather than a fresh live submission, so it should be treated as a meaningful flag rather than a comprehensive verdict.

The browser threat feed returned no threat warning for this host (observed:safe-browsing). That is a supportive point, but it only means Google had no active listing at the time of the check; it does not clear the vendor detection above and it does not tell us what the site actually does.

Connection handling is mixed. A valid TLS certificate exists for the host, but the scanned address was served over plain HTTP with no redirect to HTTPS, so the connection was not encrypted (observed:tls). For a site that presents a challenge page and may ask for input, sending anything over plain HTTP is a genuine transport risk. The hosting IP meanwhile carried an abuse confidence score of 0/100 across 0 saved reports (observed:hosting-ip-reputation), which means no abuse history was on record for the server, not that the domain itself is trustworthy.

The site's own pages could not be reviewed

Every attempt to read the site's own content failed: the server returned HTTP 429 rate limiting, including a retry as the scanner's own identity, so the site's own page, contact, About and policy text was not reviewed (observed:page-content:unavailable). We therefore cannot describe what kety.ma offers, who runs it, or how it handles visitors' data, because nothing on the site was actually read.

The only direct view of the site's presentation is a challenge screen reading "One more step" and "I'm not a robot" (derived:vision-observation:1, derived:vision-observation:2). That is consistent with an automated bot gate, possibly a CDN or anti-bot interstitial, rather than a content page. It explains the rate limiting as an access restriction, but it also means the destination behind the gate is entirely unknown to this review.

The registration history gives some context: the registrable domain is about 1002 days old (observed:domain-age), which is not a brand-new throwaway domain. Age alone does not vouch for a site's conduct, and here it is outweighed by the unresolved phishing-class vendor flag and the complete absence of readable content.

Operator and visitor risk remain unverified

Because the server refused the fetch, there is no operator identity, no contact information and no commercial flow to assess (observed:page-content:unavailable). No cross-domain checkout, subscription mechanism or affiliate funnel was observed, so no specific commercial deception can be asserted for this domain.

The open concern is the combination: a phishing-class detection recorded by an antivirus family (source:antivirus:aggregate) on a host that hides its entire content behind a bot gate (observed:page-content:unavailable). That pattern is compatible with a site used for credential harvesting or intermediary redirects, but it is not proof of either. Until someone reads the actual pages, the honest position is elevated caution rather than a confirmed scam label.