kometalove[.]com

Analysis of kometalove.com, observed as offline at the time of review (July 24, 2026), indicates it was used in a generic phishing campaign. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is hosted on a server located in the Netherlands (AS58061 Scalaxy B.V.) reachable at 176.97.79.105. DNS resolution is delegated to Cloudflare name servers fish.ns.cloudflare.com and hasslo.ns.cloudflare.com, suggesting the operators leveraged Cloudflare’s CDN and mitigation services. The site presented a HTTP 403 Forbidden response and did not present an SSL certificate, which is consistent with a temporary takedown or a defensive block.

VirusTotal recorded a single positive detection among 95 scanned engines, and the domain appears on one external blocklist, specifically PhishDestroy, confirming at least one security vendor has flagged it. No additional public intelligence, such as Safe Browsing or OTX entries, is available. The limited detection footprint implies the phishing infrastructure was either short‑lived or quickly disrupted. Defenders should block the domain and its associated IP address at network perimeter devices, add the domain to URL filtering policies, and monitor for any future reuse of the same registrar or hosting ASN.

Continuous monitoring of Cloudflare‑associated name servers for newly registered domains with similar characteristics is advisable, as threat actors often recycle such infrastructure. Because the site is currently offline, further forensic collection is constrained, and the exact phishing payload or targeted brand remains unknown. Researchers should request full packet captures from upstream sensors if available and consider submitting the domain to additional threat‑intel sharing platforms to improve collective visibility.