app-kintara[.]xyz

This domain is flagged as a high-risk cryptocurrency phishing threat targeting users with a fraudulent 5% Total Value Locked (TVL) distribution scheme. Analysis indicates the page title, 'Kintara: 5% TVL Distribution,' is designed to deceive victims into believing they are interacting with a legitimate token distribution event, likely prompting them to connect wallets or disclose private keys under false pretenses. The domain specifically mimics Kintara, a known blockchain project, to exploit user trust in decentralized finance (DeFi) reward mechanisms. Infrastructure analysis reveals multiple technical indicators of malicious intent. The domain was registered on June 16, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with phishing campaigns. It resolves to the IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.), a network commonly used to obfuscate malicious infrastructure. VirusTotal reports 3 out of 95 security vendors flagging the domain as malicious, while it appears on 3 distinct security blocklists. The SSL certificate, issued by Google Trust Services (WE1), further confirms the domain's active status and attempts to appear legitimate. Users who visited app-kintara.xyz should immediately revoke any wallet permissions granted to the domain and monitor connected accounts for unauthorized transactions. If sensitive information, such as seed phrases or private keys, was entered, affected wallets must be considered compromised. Users should transfer remaining assets to a new, secure wallet and report the incident to relevant blockchain security teams. Additionally, network-level blocking of the domain (app-kintara.xyz) and its resolving IP (188.114.96.3) is recommended to prevent further exposure.