kometwust[.]click

Analysis of kometwust.click indicates this domain was actively involved in a crypto gambling scam impersonating the Camelot brand. The domain, registered on October 14, 2025, through Web Commerce Communications Limited, resolved to the IP address 172.67.164.52, hosted on Cloudflare's infrastructure (AS13335) in the United States. Nameservers cesar.ns.cloudflare.com and nucum.ns.cloudflare.com were in use, and no SSL certificate was detected, increasing exposure to interception risks. The page title, 'Kometa Casino,' aligns with the identified scam type of crypto gambling, and the domain was associated with the Gambler Scam phishing kit.

Security vendor detections were limited but notable: 11 of 95 vendors on VirusTotal flagged the domain as malicious. Gridinsoft assigned a trust score of 0/100, and the domain appeared on one security blocklist. AlienVault OTX included it in a single threat intelligence pulse, suggesting limited but confirmed malicious activity. PhishDestroy blocked the domain, and as of July 24, 2026, it is offline, though historical resolution and registration data remain relevant for tracking.

Defenders should treat this domain as part of a broader crypto gambling scam campaign targeting users through brand impersonation. While the exact content of the site is not analyzed, the combination of Cloudflare hosting, lack of SSL, and low vendor detection rates may indicate efforts to evade automated scanning. Monitoring for re-registration or reuse of the infrastructure (e.g., nameservers, IP ranges) is recommended. No evidence suggests this domain was used for credential harvesting beyond its gambling scam classification.