portal-kinetiq[.]xyz

This domain is flagged as a crypto drainer phishing site designed to compromise cryptocurrency wallet credentials through a deceptive interface labeled 'New Private Tab.' Analysis indicates the site employs malicious JavaScript libraries, including crypto-js, to facilitate unauthorized transactions or credential harvesting. The infrastructure is structured to mimic legitimate wallet access portals, increasing the likelihood of successful social engineering attacks against users. Infrastructure analysis reveals the domain portal-kinetiq.xyz was registered on June 09, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The site is currently offline but was previously hosted behind Cloudflare, utilizing HTTP/3 and Cloudflare Browser Insights for performance and evasion. Detection metrics show 0/95 detections on VirusTotal, though it appears on four security blocklists and two AlienVault OTX threat intelligence pulses. Gridinsoft assigns a trust score of 0/100, reinforcing its classification as malicious. Additional technical indicators include the use of jsDelivr for content delivery, which may have been leveraged to load obfuscated or dynamically generated attack payloads. Mitigation measures for this crypto drainer threat include immediate blacklisting of the domain across all network security controls, including DNS filters, web proxies, and endpoint protection systems. Organizations should monitor for connections to the domain or associated IP ranges and investigate any historical access logs for potential compromise. Users who may have interacted with the site should revoke active wallet sessions, transfer assets to a new wallet, and scan devices for malware. Security teams are advised to hunt for indicators of compromise, such as unusual outbound connections to Cloudflare-hosted endpoints or the presence of crypto-js in web traffic logs, which may indicate attempted credential theft or transaction manipulation.