kiichainfoundation[.]com

The domain kiichainfoundation.com is currently flagged as an active high‑risk credential phishing site. According to the latest intelligence, the domain was registered on May 28 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is protected by a Let’s Encrypt certificate (identifier E8). HTTP requests return status 200 and the server presents Cloudflare Browser Insights, Cloudflare services, and HTTP/3 support. Network resolution points to the IP address 104.21.23.125, which belongs to Cloudflare, Inc. and is geolocated in Canada. The use of Cloudflare’s reverse‑proxy infrastructure masks the origin of the hosting environment, a common technique for phishing operators seeking to evade takedown. The observed TLS configuration is consistent with Let’s Encrypt issuance, offering modern encryption without indicating any additional security controls on the backend. Reputation metrics are uniformly negative. Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal reports a single positive detection out of 95 scanned security vendors. The domain appears on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as credential phishing. No further detail about the hosted content has been published, so the exact phishing lure remains unverified. Defenders should treat any traffic to kiichainfoundation.com as malicious. Immediate actions include adding the domain to deny‑list rules, enforcing DNS‑level blocking, and monitoring for related resolutions to the same Cloudflare IP range. Where possible, sinkholing the domain or redirecting queries to a safe‑browse page can reduce user exposure. Continuous re‑evaluation is advised, as the underlying infrastructure may change once the proxy is altered.