kometajet[.]com

This domain, kometajet.com, is flagged as a generic phishing site targeting users of Kometa Casino, a known online gambling platform. Analysis indicates the site was designed to harvest login credentials, payment details, or deploy malicious payloads under the guise of a legitimate casino brand. No specific drainer kit signatures were identified in initial scans, but the infrastructure aligns with common phishing toolkits used for financial fraud operations. The domain’s design and branding closely mimic Kometa Casino, suggesting an intent to deceive users into divulging sensitive information. Infrastructure analysis reveals the domain was registered on June 23, 2025, through NiceNIC International Group Co., Limited. It resolves to the IP address 212.11.64.170, a host with a history of association with malicious domains. VirusTotal detection rates show 4 out of 95 security vendors flagged the domain as malicious, while it appears on one security blocklist and is blocked by at least one threat intelligence feed. The domain’s creation date and rapid inclusion in blocklists suggest a short-lived, high-velocity phishing campaign typical of credential theft operations. As of the latest assessment, kometajet.com has been taken offline, likely due to hosting provider intervention or registrar suspension. While the immediate threat is mitigated, residual risks remain for users who may have interacted with the domain during its active period. Organizations and individuals are advised to monitor for unauthorized transactions, reset credentials for any accounts accessed via the site, and implement multi-factor authentication on gambling or financial platforms. Network defenders should update blocklists to include the domain and its associated IP address to prevent future access attempts.