Kling AI official domain: avoid lookalike sites with Kling 4.0

Short answer

Per TechTimes (read 2026-10-04), kling.ai is the official Kling domain, and the lookalikes klingaimedia.com and klingaistudio.com were used to spread malware in May 2025. With Kling 4.0 not yet fully released, expect more copycat download pages. Do not install, sign in or pay on any domain you reached from an ad or a search snippet. Type kling.ai yourself, or use an API key from a platform you already trust.

What to check before you enter a card or a password

Why this week is risky

Kling 4.0 Flash entered a closed beta on Sep 28 for Ultra yearly subscribers, and full Kling 4.0 is expected in October. A model that is announced but not generally open is exactly where fake access sells. Any site that offers it to everyone today is claiming more than the reports support.

If you need Kling video from an API today

Sume lists Kling 3 as the model id kling-3, billed at provider list times 1.25, which is $0.14 a second with audio off and $0.21 with audio on. You authenticate with an API key in a bearer header against https://api.sume.com, with no desktop download. List what is live first:

curl https://api.sume.com/v1/videos/models \
  -H "Authorization: Bearer $SUME_API_KEY"

If something is already installed

If you or a teammate ran an installer from a page that was not kling.ai, assume the machine and any saved browser passwords are exposed. Disconnect it from the network, run a malware scan from known-good tooling, rotate the passwords stored in that browser from a clean device, and revoke any API keys that were in environment files on it. For Sume specifically, API keys are created and revoked in the dashboard, so revoking a key you pasted into a suspect tool takes seconds.

Going forward, keep a short allow-list of vendor domains in your team wiki: the official site, the official status page and the API base URL. When a launch is announced, check the announcement against that list before anyone clicks through. This is dull but cheap, and it works for every vendor, not only Kling.

Caveats

• Kling's own release-notes page did not render its body when read, so the domain claim rests on TechTimes.
• Sume does not list Kling 4.0 today; see what to use today.
• If you suspect you installed something from a lookalike, treat it as a security incident: disconnect, scan and rotate passwords from another device.