kineticallyai[.]pages[.]dev

This domain, kineticallyai.pages.dev, is under investigation for phishing activity targeting small business owners with a fraudulent AI automation service. Registered on April 21, 2026, through Cloudflare, the domain currently resolves to 172.66.44.237 (Cloudflare infrastructure in Canada) and returns an HTTP 200 status. The page title, 'Kinetically AI — Never Miss a Lead Again. Voice & Workflow Automation for Small Businesses,' suggests a lure designed to attract users seeking productivity tools. Infrastructure analysis reveals Cloudflare nameservers (rita.ns.cloudflare.com, tanner.ns.cloudflare.com), HSTS enforcement, and technologies including Tailwind CSS and HTTP/3, which are consistent with modern phishing sites leveraging legitimate CDN services to evade detection. The domain appears on one security blocklist (PhishDestroy) but has not been flagged by any of the 94 vendors that scanned it on VirusTotal. The absence of detections does not confirm safety, as phishing domains often evade initial scans. The SSL certificate is issued by Google Trust Services (WE1), a common practice among both legitimate and malicious sites. Gridinsoft assigns a trust score of 0/100, indicating high suspicion. No concrete evidence of credential harvesting or payload delivery has been confirmed at this stage, but the domain remains active and should be treated as a potential threat. Defenders should monitor network traffic for connections to 172.66.44.237 or kineticallyai.pages.dev, particularly from small business environments. Blocking the domain at the DNS or proxy level is recommended pending further analysis. If internal users report exposure, reset credentials and review logs for anomalous authentication attempts. Additional investigation is required to determine the full scope of the campaign and any associated infrastructure.