app-kamino-finv2[.]top

The domain app-kamino-finv2.top was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is currently offline. Technical inspection shows the domain resolves to the IP address 172.67.132.176, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. The authoritative name servers are chris.ns.cloudflare.com and daniella.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. No TLS certificate is presented for the site, and HTTP requests return no content because the service has been taken down.

The page title observed before takedown was "Swap | Limit Orders | Kamino Finance," and the domain is documented as impersonating the brand Hashflow. The campaign is classified as wallet/seed phishing, targeting users who may be persuaded to disclose private keys or recovery phrases. VirusTotal analysis recorded 15 detections out of 93 security vendors, confirming that multiple reputable scanners regard the domain as malicious. Additional defensive feeds have flagged the domain: PhishDestroy lists it as blocked, Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one external security blocklist.

These independent signals corroborate the malicious intent. While the site is no longer reachable, the infrastructure footprint—including Cloudflare hosting and the lack of a valid SSL certificate—remains observable and can be used for attribution. Defenders should continue to block the domain at network perimeter, update URL filtering and threat‑intelligence platforms with the observed indicators of compromise, and monitor for any resurgence of similar sub‑domains that may reuse the same registrar or hosting provider. Ongoing vigilance is advised for any traffic attempting to resolve to 172.67.132.176 or to reference the "Swap | Limit Orders | Kamino Finance" title, as these artifacts may appear in future phishing campaigns targeting Hashflow users.