kiteop[.]xyz

Analysis indicates that the domain kiteop.xyz was registered on 21 February 2026 through NiceNIC International Group Co., Limited. The authoritative nameservers cheryl.ns.cloudflare.com and gordon.ns.cloudflare.com resolve the domain to the Cloudflare edge address 104.21.91.213, which is associated with AS13335 (Cloudflare, Inc.) located in the United States. The site presented the page title “Kite Foundation”, suggesting an attempt to masquerade as a legitimate foundation or charitable organization, although no additional branding evidence is available. TLS termination is performed by Google Trust Services using the WE1 certificate, confirming that the connection was encrypted with a trusted root.

Network detection shows support for HTTP/3, consistent with Cloudflare’s modern delivery stack. VirusTotal has recorded five detections out of ninety‑three scanned engines, indicating that multiple security vendors have flagged the domain as malicious. The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy mitigation service. Its current operational status is offline, which may be the result of takedown actions or the host’s own removal of the content.

Uncertainty remains regarding the specific phishing payload, credential collection mechanisms, or any hosted malware, as no page content or URL path information is available. Defenders should continue to enforce blocklisting of the IP address 104.21.91.213 and the domain name, monitor for any re‑hosting on alternative Cloudflare‑protected addresses, and ensure that endpoint protection solutions incorporate the VirusTotal detection signatures. Additional investigation of the original page content, if archived, would be required to determine the exact victim targeting and credential‑capture technique. Until such data is obtained, the domain should be treated as a high‑confidence phishing indicator and included in network and email filtering rules.