kinietq[.]xyz

Analysis of kinietq.xyz confirms it as a brand-impersonation scam site targeting the Across protocol, operational since February 21, 2026. The domain was registered through Dynadot LLC and hosted on Cloudflare infrastructure (AS13335), resolving to IP 172.67.176.186 in the United States. No SSL certificate was detected, increasing exposure to interception risks. The page title 'Kinetiq' suggests an attempt to mimic legitimate services, though the exact content and functionality remain unconfirmed due to the site's current offline status. Infrastructure analysis reveals the use of Cloudflare nameservers (dayana.ns.cloudflare.com, elliot.ns.cloudflare.com) and multiple front-end technologies, including jsDelivr, cdnjs, crypto-js, and HTTP/3.

HSTS is enforced, which may complicate passive inspection but does not mitigate the underlying threat. The domain appears on four security blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL, and is flagged by 4 of 93 vendors in VirusTotal scans. Gridinsoft assigns a trust score of 0/100, reinforcing its malicious classification. Defenders should treat this domain as a confirmed threat vector for brand impersonation.

Blocklist enforcement is recommended at the DNS and network levels, particularly for organizations interacting with the Across ecosystem. Given the domain's offline status as of July 24, 2026, further forensic analysis may be limited, but historical logs should be reviewed for prior connections. No evidence of a phishing kit or specific payload is available, so monitoring for reactivation or related domains (e.g., typosquats, similar Cloudflare-hosted sites) is advised. The lack of SSL and reliance on Cloudflare infrastructure are consistent with low-effort scam operations, though the use of modern protocols like HTTP/3 suggests some technical sophistication.