kinetqi-foundation[.]org

The domain kinetqi-foundation.org has been identified as a brand_impersonation threat specifically targeting Binance, a cryptocurrency exchange platform. This domain is currently offline, though prior analysis indicates it was actively used for deceptive purposes. The threat type aligns with fraudulent schemes designed to mimic legitimate services, likely to harvest credentials or distribute malicious payloads under the guise of the targeted brand. Analysis indicates the domain was flagged by 6 of 95 security vendors on VirusTotal, reflecting moderate detection coverage. It was registered through NiceNIC International Group Co., Limited on February 21, 2026, an unusual creation date that may suggest domain spoofing or backdating. The domain resolved to the IP address 188.114.97.3 and was protected by an SSL certificate issued by Google Trust Services. Infrastructure analysis reveals the use of Cloudflare and HTTP/3, common among threat actors to obscure hosting origins. The domain appears on one security blocklist and received a trust score of 0/100, further corroborating its malicious classification. At present, kinetqi-foundation.org is offline, though residual risk remains due to potential re-activation or migration to alternative infrastructure. Organizations are advised to block the domain and its associated IP address at the perimeter level. Security teams should monitor for similar impersonation attempts, particularly those leveraging Cloudflare or unusual registration dates. End-users should be educated on verifying domain authenticity before interacting with cryptocurrency-related platforms, and multi-factor authentication should be enforced to mitigate credential theft risks.