kolo[.]nano-dev[.]shop

Analysis of the domain kolo.nano-dev.shop indicates that it is currently offline but was previously identified as a generic phishing site. The authoritative DNS resolution points to the single IPv4 address 198.12.80.250, which is hosted in the United States by AS36352, a network operated by HostPapa. The registration record lists the registrar identifier CC-198-12-80-248-29 with the same ASN, confirming that the domain’s infrastructure is tightly coupled to this hosting provider. An inspection of the web page revealed a title tag containing the word “luno”, but no further content has been captured; the site does not present an SSL/TLS certificate, leaving all HTTP traffic unencrypted.

Reputation services provide a Gridinsoft trust score of 0 out of 100, indicating a lack of confidence in the host. VirusTotal has flagged the domain in six out of ninety‑five scanned engines, reinforcing the malicious classification. The domain is listed on at least one public phishing blocklist and is actively blocked by the PhishDestroy service. Defenders should update perimeter filters to deny traffic to 198.12.80.250 and add kolo.nano-dev.shop to internal blocklists.

Monitoring of HostPapa’s ASN for any new domains that resolve to the same IP range is advisable, as the provider may be leveraged for additional phishing infrastructure. Because the site is offline, real‑time verification of payloads or credential‑harvesting forms is not possible; however, the combination of a zero trust score, multiple vendor detections, and blocklist presence suggests a high likelihood of malicious intent. Organizations should treat any email or message directing users to this domain as hostile and enforce standard phishing mitigation controls, including URL filtering, user education, and incident response escalation if compromise is suspected.