proposals-kinetiq[.]xyz

The domain proposals-kinetiq.xyz has been identified as part of a crypto drainer infrastructure, designed to siphon cryptocurrency assets from targeted wallets. As of the latest assessment, the domain is currently offline, though prior activity indicates it was actively used in malicious campaigns. No direct brand impersonation has been confirmed, but the domain follows patterns consistent with wallet-draining schemes observed in recent threat clusters. Analysis of the domain reveals it was registered on June 10, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 188.114.96.3, which has been flagged in four distinct threat intelligence pulses on AlienVault OTX. Despite its malicious nature, the domain has not been detected by any of the 95 vendors on VirusTotal, indicating either evasion techniques or recent deployment. It appears on four security blocklists and holds a trust score of 0/100 from Gridinsoft, further corroborating its classification as malicious infrastructure. Additional protective measures have been implemented by multiple wallet security providers, suggesting prior abuse in live attack scenarios. The current offline status of proposals-kinetiq.xyz does not eliminate the risk, as threat actors frequently reactivate or migrate domains to new infrastructure. Organizations and individuals are advised to proactively block the domain and its associated IP address (188.114.96.3) at the network perimeter. Wallet users should verify transaction prompts against known legitimate interfaces and avoid interacting with unsolicited links or pop-ups referencing this domain. Security teams are encouraged to monitor for related domains registered under the same registrar or resolving to the same IP, as these may represent follow-on infrastructure. Continuous threat intelligence monitoring is recommended to detect resurgence or evolution of this campaign.