kinetiq[.]finance

Kinetiq.finance emerges as a notable phishing threat, flagged by 3 out of 91 vendors on VirusTotal. This domain, registered through Dynadot Inc, is hosted on Amazon infrastructure in the US, specifically on IP address 54.215.31.113. The domain holds a platform risk score of 71 out of 100, indicating a significant threat level.

The domain's SSL certificate is issued by Let's Encrypt, a common choice for malicious actors due to its free and automated nature. Despite being active since September 2025, kinetiq.finance was first detected by PhishDestroy in June 2026, suggesting a period of undetected activity. The domain's presence on PhishDestroy's blocklist further underscores its malicious intent.

The phishing operation behind kinetiq.finance likely exploits financial themes, given its domain name. The 21 out of 100 abuse score indicates some level of reported malicious activity, but not enough to trigger widespread blocking. This domain's activity highlights the ongoing challenges in detecting and mitigating phishing threats, especially those leveraging reputable hosting services and SSL certificates.

The use of Amazon's hosting infrastructure provides the domain with a veneer of legitimacy, potentially deceiving users into trusting its content. The combination of a relatively low abuse score and early detection by PhishDestroy emphasizes the importance of proactive threat intelligence in identifying and neutralizing emerging threats before they can inflict significant harm.