kinetiq-fountation[.]org

Analysis of kinetiq-fountation.org, created on February 21, 2026 and registered through NiceNIC International Group Co., Limited, shows a high‑risk phishing infrastructure. The domain resolves to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc., and is served by Cloudflare nameservers edward.ns.cloudflare.com and lara.ns.cloudflare.com. TLS termination is provided by a Google Trust Services certificate (WE1), and the site negotiates HTTP/3, returning an HTTP 301 redirect for the observed request. The sole page title retrieved is "Terms of Use | Kinetiq foundation," offering no further insight into the malicious payload; the page content beyond the title has not been publicly disclosed.

Security assessments indicate a Gridinsoft trust score of 0 / 100 and a detection rate of 3 out of 93 vendors on VirusTotal, suggesting that multiple reputable scanners have flagged the domain. The site appears on one public blocklist and is actively blocked by PhishDestroy, confirming its classification as a phishing resource. The identified phishing kit is labeled “Seed Phrase Phishing,” implying attempts to harvest cryptocurrency seed phrases or related credentials.

While the exact landing pages and credential‑capture mechanisms remain unverified, the convergence of low trust rating, vendor detections, blocklist presence, and the known kit strongly supports a confirmed phishing threat. Defenders should add kinetiq-fountation.org to URL filtering and DNS blocklists, monitor traffic to its Cloudflare‑hosted IP, and consider sinkholing or null‑routing the address. Continuous re‑scanning is advised to capture any changes in payload or additional indicators that may emerge as the campaign evolves.