app-kindredlabs[.]xyz

app-kindredlabs.xyz is currently classified as a high‑risk generic phishing infrastructure. The domain was registered on April 29 2026 through Dynadot LLC and immediately pointed to Cloudflare’s network (172.67.154.204) using the authoritative name servers miles.ns.cloudflare.com and stephane.ns.cloudflare.com. The hosting IP resolves to a Cloudflare, Inc. location in Canada, and the TLS certificate is issued by Let’s Encrypt (E7), indicating a valid but easily obtainable certificate. Open Threat Exchange (OTX) lists the domain in a single pulse, and four independent security blocklists have added it to their watchlists. It is actively blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL. Gridinsoft’s trust score for the domain is 0 / 100, and VirusTotal reports that 5 of 95 scanned security vendors flag the domain as malicious. An HTTP GET to the domain returns a 403 Forbidden response, preventing direct observation of the landing page content. No additional infrastructure such as email servers, sub‑domains, or related URL paths have been publicly disclosed, leaving the exact phishing lure and target brand ambiguous. The combination of recent registration, use of Cloudflare’s edge network, low trust score, and multiple blocklist listings suggests a deliberate attempt to exploit the fast‑deployment capabilities of Cloudflare for phishing campaigns. The presence of a Let’s Encrypt certificate further indicates that the operators are leveraging free TLS to increase perceived legitimacy. Defenders should add app-kindredlabs.xyz to network‑level deny lists and configure DNS‑sinkholing to capture any future resolution attempts. Continuous monitoring of the associated IP address and the two Cloudflare name servers is advised, as the operators may shift to additional IPs or create sibling domains. Incident response teams should also query threat‑intel feeds for any emerging OTX pulses that reference the domain.