mail[.]kaminocoin[.]xyz

On July 24 2026 analysts observed that the domain mail.kaminocoin.xyz was associated with a brand‑impersonation campaign targeting Kamino. The site, which displayed the page title “KaminoCoin – Clone Force 99 Network,” was registered on 10 October 2025 through Synergy Wholesale Accreditations Pty Ltd and resolved to the IPv4 address 110.232.143.135, an address allocated to AS45638 (Synergy Wholesale Pty Ltd) in Australia. DNS resolution used the authoritative nameservers ns1.syd7.hostyourservices.net and ns2.syd7.hostyourservices.net. The web server presented a Let’s Encrypt certificate (R13) and operated on LiteSpeed with HTTP/3 support, loading JavaScript libraries from jsDelivr and rendering charts via Chart.js.

Security telemetry indicates the domain appears on one public blocklist and is listed by PhishDestroy as blocked. VirusTotal scans reported that two of ninety‑five AV engines flagged the domain, and Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious assessment. The domain’s status is currently taken offline, which limits active threat exposure but does not eliminate the risk of re‑use or of related infrastructure being repurposed.

Open questions remain regarding the specific payload or credential‑harvesting mechanisms employed, as no page content has been publicly captured. Defenders should continue to block the domain and its resolved IP at perimeter defenses, monitor the associated nameservers for new sub‑domains, and add the IP range to threat‑intel feeds. Additional surveillance of newly registered domains that share the “kaminocoin.xyz” suffix or the same registrar may help detect future iterations of this campaign.