kaminotestresolve-ab5[.]pages[.]dev

Analysis of kaminotestresolve-ab5.pages.dev indicates a high‑risk brand‑impersonation campaign targeting the Kamino brand. The domain was registered on December 18 2025 through Cloudflare, Inc. and points to the IP address 188.114.97.3, which belongs to AS13335 (Cloudflare, Inc.) in the United States. The site presents the Cloudflare‑generated page title “Suspected phishing site | Cloudflare” and returns an HTTP 403 response, consistent with a taken‑offline status. Google Safe Browsing classifies the domain as social‑engineering, and 13 of 95 VirusTotal scanners have generated detections, reinforcing its malicious nature.

The host appears on three independent security blocklists and is explicitly listed by PhishDestroy, MetaMask, and SEAL as a blocked resource. Additional telemetry shows a Gridinsoft trust score of 0 / 100, and the SSL certificate is issued by Google Trust Services under the WE1 profile, which is typical for Cloudflare‑proxied sites. Detected technologies include HSTS, HTTP/3, and Cloudflare’s edge services, while the authoritative nameservers are keenan.ns.cloudflare.com and surina.ns.cloudflare.com. The observable evidence confirms that the domain is being used to impersonate Kamino, likely to harvest credentials or redirect victims to malicious content.

No content analysis beyond the page title is available, and the offline status prevents direct content inspection, leaving the exact payload unknown. Defenders should continue to block the domain at network perimeter and DNS layers, update IDS/IPS signatures to include the observed IP and hostname, and monitor for any resurgence of the domain or associated infrastructure. Ongoing observation of Cloudflare‑assigned IP ranges for similar newly‑created domains is advised, as the attacker may repurpose the same hosting assets for future campaigns.