Protocol-impersonator domain registered (typosquat)

Evidence summary #

RED. Threshold: a typosquat of the official domain registered within last 90 days. Finding: at minimum 5 simultaneously active impersonating domains found in standard Google searches (2026-05-17): (1) kinietiq.io — letter transposition (ki-nie-tiq vs ki-ne-tiq); (2) kinietiq.co — same transposition, different TLD; (3) kineitiq.cc — letter insertion, Google snippet 'Premier Liquid Staking | Hyperliquid Staking Solutions' — actively imitating Kinetiq's core product value prop; (4) klnetiq.xyz — l substituted for first i, SAME .xyz TLD as official kinetiq.xyz — highest deception potential; (5) kinetiq-hyperliquid.com — descriptive append impersonator. Additionally kinetiqai.xyz observed. Registration date of specific domains not confirmed without WHOIS API access, but active presence in search results contemporaneous with Kinetiq's high-attention period strongly implies recent registration. At least kinietiq.cc/kineitiq.cc and klnetiq.xyz present themselves as liquid staking protocol UIs.

Sources #

Methodology #

Determine whether a typosquat of the official protocol domain has been registered in the last 90 days.

See the full factor methodology and distribution across all protocols →