kintaras[.]app

This domain, kintaras.app, presents itself as an isometric massively multiplayer online game titled 'Kintara' to deceive users into downloading malicious software designed for credential harvesting. The site mimics legitimate gaming platforms, leveraging social engineering tactics to exploit users' trust in gaming communities. Analysis indicates the primary threat involves the distribution of malware capable of extracting sensitive information, including login credentials, financial data, and personal identification details, which can be used for further cybercriminal activities such as identity theft or financial fraud. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification of this domain. The domain was registered on May 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 172.67.128.107, hosted on Cloudflare's network (AS13335), a common tactic to obfuscate the true origin of malicious traffic. The domain is flagged by 3 security blocklists, including PhishDestroy, MetaMask, and SEAL, and has been detected by 1 out of 95 security vendors on VirusTotal. Additionally, the domain employs a Let's Encrypt SSL certificate (YE2), which, while providing encryption, does not validate the legitimacy of the site's content or intent. Users who have visited kintaras.app or interacted with its content should take immediate action to mitigate potential risks. Disconnect the device from the network to prevent further data exfiltration and perform a full system scan using updated antivirus or anti-malware tools to detect and remove any malicious payloads. Reset all credentials, particularly those related to financial services, email accounts, and gaming platforms, using a separate, secure device. Monitor accounts for unauthorized activity and enable multi-factor authentication where available. If personal or financial data was entered on the site, consider reporting the incident to relevant authorities and credit monitoring agencies to prevent identity theft.