kinetiq-foundtion[.]org

Analysis as of July 24, 2026 shows that the domain kinetiq-foundtion.org is actively being used for phishing. The site was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is hosted behind Cloudflare (ASN 13335) with the IP address 188.114.97.3 located in the United States. DNS resolution uses the Cloudflare name servers edward.ns.cloudflare.com and lara.ns.cloudflare.com. The web server presents a valid SSL certificate issued by Google Trust Services under the WE1 designation and enforces HSTS while supporting HTTP/3. An HTTP 301 redirect is observed, and the only page title currently retrieved is “Terms of Use | Kinetiq foundation”, which does not provide any indication of malicious content but confirms that the domain resolves to a live site. Threat intelligence flags the domain on one security blocklist and it is listed as blocked by PhishDestroy.

Malware scanning on VirusTotal reports that three of ninety‑three AV engines have flagged the domain, reinforcing the suspicion. The Gridinsoft trust score is 0 out of 100, indicating a high likelihood of abuse. The campaign is associated with the “Seed Phrase Phishing” kit, a known generic phishing framework that targets cryptocurrency seed phrases. No additional evidence such as phishing landing pages or credential harvesting forms has been captured publicly, so the exact victim‑facing content remains uncertain. Defenders should treat kinetiq-foundtion.org as a high‑risk phishing indicator.

Network‑level controls should block outbound connections to the IP 188.114.97.3 and to the domain itself. Email security gateways should add the domain to blocklists and enable URL filtering. Endpoint protection solutions should incorporate the three VirusTotal detections and the Gridinsoft score when evaluating alerts. Continuous monitoring of the domain’s DNS records is advised, as Cloudflare may hide underlying infrastructure changes.