kamlno[.]top

The domain kamlno.top was registered on 2 April 2026 through Global Domain Group LLC. It is currently marked as active and classified with a high risk rating. The site presents a page titled “Обменник криптовалют Fox Changer. БезопасныÐй и наличныÐе …”, which is consistent with the observed AML‑scam template. The content is served over HTTPS using a Let’s Encrypt certificate (issuer E8). Technical analysis shows that kamlno.top resolves to the Cloudflare edge address 188.114.96.3, which is announced by Cloudflare, Inc. The authoritative name servers are art.ns.cloudflare.com and chan.ns.cloudflare.com, both belonging to the same provider. HTTP requests return status 200, indicating the site is fully operational and delivering the malicious payload. Threat intelligence sources have recorded the domain in eight separate AlienVault OTX pulses and on three public security blocklists. It is also listed as blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans have resulted in four of ninety‑five security vendors flagging the domain as malicious, and Gridinsoft assigns a trust score of 0 out of 100. The campaign impersonates the brand Kamino, leveraging the brand’s reputation to lure victims into an AML‑related financial deception. Defenders should proactively block kamlno.top at the DNS and gateway layers, as well as the associated IP address 188.114.96.3, to prevent client connections. Email filters should be updated to detect references to the Kamino brand combined with AML terminology. Continuous monitoring of Cloudflare‑hosted infrastructure and periodic re‑scanning with updated AV engines are recommended to capture any further evolution of the campaign.