# PhishDestroy threat dossier — xn--kamno-1sa.app ================================================================ Fetched: 2026-04-27 18:27:50 UTC Canonical: https://phishdestroy.io/domain/xn--kamno-1sa.app/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 96/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Kamino ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 1/95 security vendors flagged this domain Flagging vendors: ThreatHive ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 147.45.110.175 Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED !!! REGISTRAR INTEGRITY ALERT — NiceNIC !!! NiceNIC International: over 90% of its registered domains are associated with illegal content; documented systematic abuse-report non-response. Primary sources: https://phishdestroy.io/nicenic-real https://phishdestroy.io/nicenic-verdict Nameservers: a.dnspod.com, b.dnspod.com, c.dnspod.com Registered: 2026-04-24 Expires: 2027-04-24 Page title: Lend | Kamino Finance HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / R13 Expires: 2026-07-23 Status: INVALID chain Fingerprint: 14c71ef85fee5434bf7f622d0e81f8761dbdf8d8f49996c30e6e63cde50c6c43 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-24 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-27 10:36:16 UTC (by PhishDestroy tracker) First reported: 2026-04-27 07:37:35 UTC (abuse notice filed) Last verified: 2026-04-27 19:32:21 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019dcddb-ccd9-72e4-99d8-6e0211c02284/ URLQuery: https://urlquery.net/report/4b1f452d-0acd-458d-a224-b5a55d6fa239 Wayback Machine: https://web.archive.org/web/*/xn--kamno-1sa.app crt.sh CT logs: https://crt.sh/?q=%25.xn--kamno-1sa.app Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=xn--kamno-1sa.app AlienVault OTX: https://otx.alienvault.com/indicator/domain/xn--kamno-1sa.app URLhaus: https://urlhaus.abuse.ch/host/xn--kamno-1sa.app/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-27 10:37:10 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies xn--kamno-1sa.app as an active phishing domain posing a generic phishing threat to unsuspecting users. This domain was flagged with a risk level marked under_investigation but is actively monitored due to its malicious intent. The threat involves deception through impersonation to harvest sensitive credentials or deliver malware. xn--kamno-1sa.app resolves to the IP address 147.45.110.175 and currently evades detection with zero VirusTotal detections out of 95 engines as of seed 52802c. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, and employs a Let’s Encrypt SSL certificate to appear legitimate. Registered on April 24, 2026, this domain is newly active, which raises red flags given its lack of reputation and zero detections despite its suspicious activity. No blocklist or trust scores were found supporting its legitimacy. Users encountering xn--kamno-1sa.app should avoid clicking links, downloading files, or entering any personal information. Verify the domain’s legitimacy by cross-checking URLs, ensuring HTTPS encryption, and consulting reputable threat intelligence sources. If this domain was encountered via email or message, report it to the appropriate cybersecurity team or platform provider. Monitor financial accounts and devices for unusual activity, and consider blocking the IP 147.45.110.175 at the network level if necessary to prevent further exposure. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260427-144873 Favicon MD5: b676854ed167bbf2a5207386a5078371 TLS cert SHA-256: 14c71ef85fee5434bf7f622d0e81f8761dbdf8d8f49996c30e6e63cde50c6c43 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/xn--kamno-1sa.app/ JSON API: https://api.destroy.tools/v1/check?domain=xn--kamno-1sa.app Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io