kinetiq-ffoundation[.]org

Analysis of kinetiq-ffoundation.org shows a high‑risk, active phishing infrastructure targeting cryptocurrency users through a seed‑phrase harvesting kit. The domain was registered on February 21, 2026 and resolves to the Cloudflare edge address 172.67.203.15, indicating use of Cloudflare’s CDN and DDoS mitigation services. DNS is served by edward.ns.cloudflare.com and lara.ns.cloudflare.com, and the site enforces HSTS with support for HTTP/3, suggesting a modern web stack. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming a valid HTTPS endpoint despite the malicious purpose.

An HTTP 301 redirect is observed, and the page title returned is "Terms of Use | Kinetiq foundation," which does not reflect the underlying malicious content. Security telemetry shows a Gridinsoft trust score of 0 / 100, and two of ninety‑three VirusTotal scanners have flagged the domain, reinforcing the malicious assessment. The domain appears on one external blocklist and is listed as blocked by PhishDestroy, indicating that at least some defensive feeds have already incorporated it. The phishing kit is identified as a Seed Phrase Phishing module, commonly employed in NFT‑related scams to exfiltrate private keys or recovery phrases.

While the exact landing page content has not been publicly disclosed, the combination of a freshly created domain, Cloudflare hosting, a valid Google certificate, and low trust scores aligns with known patterns of credential‑stealing campaigns. Defenders should add kinetiq-ffoundation.org to URL filtering and DNS blocklists, monitor for related C2 traffic to the 172.67.203.15 address, and update endpoint protection signatures to include the observed seed‑phrase kit indicators. Continuous observation of any changes to the domain’s hosting or certificate metadata is recommended, as threat actors often pivot to new infrastructure while retaining the same phishing payload.