kaicatsales[.]pages[.]dev

Analysis of kaicatsales.pages.dev indicates it was used for a credential‑phishing operation targeting users with a lure about a new AI‑compatible cat meme coin. The domain was registered on February 21 2026 through Cloudflare, Inc., and resolves to the IPv6 address 2a06:98c1:3120::3, which belongs to Cloudflare’s AS13335 network located in the United States. The site was protected by Cloudflare’s TLS certificate issued by Google Trust Services (WE1) and employed HTTP/3 and HSTS, suggesting a modern web stack. Access attempts now return HTTP 403, and the domain has been taken offline.

Reputation services have flagged the site: PhishDestroy and ScamSniffer have added it to their blocklists, and it appears on two additional security blocklists. The page title retrieved from the live host reads “Join KAI: The New AI‑Compatible Cat Meme Coin with Unmatched Powers,” confirming the campaign’s branding. Gridinsoft assigned a trust score of 0 / 100, reinforcing the malicious intent. No detections were reported by the 93 VirusTotal scanners, but the absence of a positive result does not constitute evidence of safety.

The infrastructure indicates a straightforward Cloudflare‑fronted hosting model without evidence of further command‑and‑control services. Defenders should immediately block the host at the DNS and network layers, monitor for any outbound traffic to the resolved IPv6 address, and update phishing‑filtering rules to include the observed page title and domain pattern. Incident response teams should also review logs for attempted credential submissions that match the campaign’s theme and consider user‑education messages that reference the “AI‑compatible cat meme coin” lure. Ongoing observation is advised in case the actors re‑register a similar domain or shift to a different hosting provider.