kinsu[.]xyz

This domain, kinsu.xyz, is flagged as a high-risk crypto wallet drainer phishing site. Analysis indicates the infrastructure is specifically designed to target Web3 users by mimicking legitimate wallet connection interfaces, as evidenced by the page title 'Web3 Connect Demo.' The threat involves unauthorized transaction signing or private key extraction, leading to direct cryptocurrency asset theft from victims' wallets. Infrastructure analysis reveals the domain was registered on May 28, 2026, through Dynadot Inc, an unusual future date suggesting potential domain spoofing or registry manipulation. It currently resolves to IP address 172.67.208.109, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. The domain appears on one security blocklist and is flagged by 5 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Let's Encrypt (YR1), a common tactic to lend superficial legitimacy to malicious sites. Mitigation steps for this specific threat type include immediate blocking of the domain and IP at the network perimeter. Web3 users should revoke any connected wallet permissions granted to suspicious sites and monitor transaction histories for unauthorized activity. Organizations should update endpoint protection rules to detect and prevent interactions with known crypto drainer domains. Security teams are advised to correlate this domain with other Web3-themed phishing infrastructure using the unique seed fe1acc for broader threat hunting.