kinetixfinance-dashboard[.]pages[.]dev

PhishDestroy identifies kinetixfinance-dashboard.pages.dev as an active crypto drainer impersonating Kinetix Finance, a blockchain-based platform. The domain leverages a Cloudflare Pages subdomain to deliver a malicious JavaScript-based drainer kit designed to siphon cryptocurrency from unsuspecting users' wallets upon wallet connection. Threat actors are likely distributing this domain via phishing campaigns targeting Kinetix Finance users, exploiting brand recognition to increase credibility and infection rates. The drainer kit is hosted on a dynamically generated subdomain, a common tactic to evade static blocklists and automate takedown resistance. This domain resolves to IP address 172.66.44.243 and is registered through Cloudflare, Inc., which provides hosting and anonymity services that obscure the true origin of the infrastructure. VirusTotal currently shows 0 detections out of 95 engines, indicating the domain has not yet been widely flagged despite its malicious activity. The domain utilizes a Google Trust Services SSL certificate, which is frequently abused by threat actors to establish trust with potential victims. No historical blocklist data is available, suggesting this domain is newly deployed and actively evading detection mechanisms. As of this report, kinetixfinance-dashboard.pages.dev remains active and operational, with no known takedown actions taken. PhishDestroy advises immediate caution for users interacting with this domain or any unsolicited links claiming to be related to Kinetix Finance. Users should verify the legitimacy of any crypto-related domains using PhishDestroy’s real-time threat intelligence platform. The remaining risk is classified as high due to the active drainer kit, low detection rate, and ongoing abuse of legitimate infrastructure providers. Regular monitoring and proactive threat intelligence sharing are critical to mitigating further infections.