aml[.]kineticq[.]xyz

Analysis of the domain aml.kineticq.xyz indicates it was associated with an investment scam, as classified in available threat intelligence. The domain was registered on March 24, 2026, through HOSTINGER operations, UAB, and resolved to the IP address 92.113.23.243, hosted in Germany under HOSTINGER DE. Infrastructure analysis reveals the use of nameservers ns1.dns-parking.com and ns2.dns-parking.com, a configuration commonly observed in low-reputation or disposable hosting setups. No SSL certificate was detected, increasing the likelihood of unencrypted communications and reducing trust signals for visitors. Technologies identified include PHP, Ant Design, React, Hostinger CDN, and HTTP/3, suggesting a modern web stack but providing no inherent indication of legitimacy.

The page title, 'Web - AMLBot,' may imply an attempt to mimic services related to anti-money laundering (AML) tools, though the exact content and intent of the site remain unconfirmed due to its offline status as of the report date. Only one security vendor flagged the domain on VirusTotal, and it appears on a single security blocklist, as per PhishDestroy. Gridinsoft assigned a trust score of 0/100, reinforcing its classification as high-risk. The domain is currently offline, which may indicate takedown action or voluntary suspension by the hosting provider. Defenders should treat this domain as compromised infrastructure.

Historical DNS and IP associations should be reviewed for potential links to other malicious campaigns. Network-level blocking of 92.113.23.243 and monitoring of newly registered domains under the kineticq.xyz subdomain are recommended. Given the investment scam classification, financial institutions and fraud detection teams should include this domain in retrospective transaction analysis to identify potential victim interactions.