kamino-finance[.]org

The domain kamino-finance.org was registered through NameSilo, LLC on 24 November 2025. Its authoritative nameservers are jill.ns.cloudflare.com and mike.ns.cloudflare.com, indicating use of Cloudflare’s DNS service. Resolution points to the IPv6 address 2606:4700:3032::ac43:d00f, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate was observed during the scan, meaning the site operated without HTTPS. The HTTP response returned a page title of “Lend | Kamino Finance,” matching the declared brand target “Kamino” and the scam type “Brand Impersonation.” VirusTotal recorded detections from six of ninety‑five scanning engines, and the domain is listed on two public blocklists – PhishDestroy and ScamSniffer.

Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. The infrastructure was taken offline before this report, and the current status is listed as offline. Analysis indicates that the domain was deliberately crafted to mimic Kamino’s financial services, likely to lure victims into a fraudulent lending workflow. The combination of a brand‑specific page title, low trust score, and multiple vendor detections aligns with elevated risk.

However, the absence of an SSL certificate and the limited number of detections leave some uncertainty regarding the full scope of the payload or credential‑harvesting mechanisms that may have been hosted. Defenders should immediately block the domain at perimeter and DNS layers, add the IPv6 address to network‑level deny lists, and ensure that any outbound connections to Cloudflare‑hosted resources are inspected for anomalous activity. Organizations using Kamino services should warn users that the domain is not legitimate, and security awareness training should reference the exact page title to improve identification. Continuous monitoring of Cloudflare‑registered domains for similar naming patterns is advised to catch future impersonation attempts.