users-kamino[.]xyz

users-kamino.xyz was registered on 13 March 2026 through Dynadot LLC. The domain resolves to IP 188.114.96.3, which belongs to AS13335 operated by Cloudflare. The authoritative name servers are aliza.ns.cloudflare.com and bill.ns.cloudflare.com, and the site serves a TLS certificate issued by Let’s Encrypt (subject E7). The infrastructure uses Cloudflare’s HTTP/3 stack.

When accessed, the server returns HTTP 403 and the page title reports a “504: Gateway time‑out”. This mismatch suggests the front‑end is deliberately configured to present an error page while keeping the underlying host reachable, a tactic commonly used to evade automated crawlers. The presence of Cloudflare and HTTP/3 indicates the operator leveraged a high‑performance CDN to hide the true origin.

The domain is actively impersonating the brand Kamino, as indicated by the naming pattern and the “users‑kamino” sub‑domain. Independent analysis platforms have flagged the site: three of ninety‑five security vendors on VirusTotal have marked it malicious, Gridinsoft assigns a trust score of 0 out of 100, and it appears on three public blocklists. Defensive feeds such as PhishDestroy, MetaMask, and SEAL already list the domain as blocked.

Defenders should add 188.114.96.3 and the full domain to network deny lists and configure email gateways to reject any messages containing URLs that resolve to this host. Continuous DNS monitoring is advised to detect any future CNAME or A‑record changes that could point to additional malicious infrastructure. Because the site is hosted behind Cloudflare, sinkholing the IP is not feasible; instead, response‑based blocking at the HTTP layer (e.g., filtering on the 403/504 status pattern) can reduce exposure. Analysts should also watch for new sub‑domains that follow the “users‑*‑kamino.xyz” pattern, as they may be spawned using the same registration account.