fix-unwrap-op[.]kamino-web[.]pages[.]dev

This domain poses a high-risk brand impersonation threat, specifically targeting users of the Phantom cryptocurrency wallet. By masquerading as the legitimate Kamino DeFi platform on Solana, the site attempts to harvest sensitive login information and private keys from unsuspecting visitors. The risk level is elevated due to the active status and the sophisticated nature of the impersonation.

Technical analysis reveals multiple red flags: VirusTotal shows 3 out of 95 security vendors flagging this domain as malicious. It appears on three independent security blocklists, yet remains active. The domain was registered through Cloudflare, Inc. on February 21, 2026, and resolves to IP address 172.66.47.73. An SSL certificate issued by Google Trust Services provides a false sense of security. Notably, the page title claims to be "Kamino | Solana Concentrated Liquidity Layer," directly mimicking the legitimate Kamino finance interface.

Users who encounter this domain should immediately close the page and avoid entering any credentials or connecting any wallets. Those who have already interacted with the site should transfer their assets to a new wallet, enable two-factor authentication, and monitor for unauthorized transactions. It is recommended to report the domain to Phantom's security team and to block the domain at the network level. Always verify URLs by typing them manually and using official bookmarks rather than clicking links from emails or social media.