kiichainfoundation[.]xyz

kiichainfoundation.xyz was registered on May 28, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain is protected by a Let's Encrypt certificate issued to the YE1 identifier and is fronted by Cloudflare services, including Cloudflare Browser Insights and HTTP/3 support. DNS resolution points to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. and is associated with the CA location. An HTTP request to the domain returns a 200 OK status, indicating that a web server is actively serving content. The site has been identified by multiple blocklists, including PhishDestroy, MetaMask, and SEAL, and appears on three security blocklists overall. VirusTotal analysis shows that six out of ninety‑five security vendors have flagged the domain as malicious, while Gridinsoft assigns a trust score of zero out of one hundred. These indicators, combined with the active HTTP response, suggest that the infrastructure is currently operational and being used to lure victims. The combination of a recent registration date, a low trust score, and multiple independent detections points to a high‑risk credential‑harvesting operation. The use of a legitimate SSL certificate and Cloudflare’s CDN can help the operators evade simple network‑level inspection, while the HTTP/3 protocol may further obscure traffic patterns. Although only a minority of scanners have marked the domain as malicious, the presence on reputable blocklists and the zero trust rating justify a high risk classification. Defenders should add 188.114.97.3 to deny lists and block any outbound connections to kiichainfoundation.xyz at the DNS or HTTP layer. Continuous monitoring of Cloudflare‑served IP ranges for similar patterns is advised, as the attacker can quickly shift to alternative addresses behind the same CDN. Security teams should also update email filtering rules to catch references to the domain and educate users about the likelihood of credential‑stealing pages hosted on this URL.