kinetiq-foundadion[.]org

The domain kinetiq-foundadion.org was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is currently active. DNS resolution points to 172.67.175.104, an address owned by AS13335 Cloudflare, Inc. in the United States. The authoritative nameservers are edward.ns.cloudflare.com and lara.ns.cloudflare.com, indicating that the site is fronted by Cloudflare’s edge network and supports HTTP/3. An HTTP 301 response is observed, suggesting a permanent redirect, but the final landing page has not been captured. The TLS certificate presented is issued by Google Trust Services under the WE1 intermediate, confirming a valid HTTPS endpoint.

The page title returned from the initial request is "Terms of Use | Kinetiq foundation," which does not reveal any overt malicious content but is consistent with a phishing kit deployment. Automated analysis identified the Seed Phrase Phishing kit, a known template used to harvest cryptocurrency recovery phrases. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious classification. The domain appears on a single security blocklist and is explicitly blocked by PhishDestroy.

VirusTotal scans report three detections out of ninety‑three scanners, providing additional corroboration of malicious activity. While the exact content served after the redirect is not publicly documented, the combination of a low trust score, known phishing kit, blocklist presence, and multiple vendor detections indicates a high‑risk threat. Defenders should add kinetiq-foundadion.org to URL filtering and DNS blocklists, monitor for any outbound connections to the associated Cloudflare IP, and enforce TLS inspection to capture the post‑redirect payload. Continuous re‑scanning is advised to detect any changes in the site’s behavior or additional malicious payloads.