kmtaswit[.]space

This domain is flagged for elevated-risk brand impersonation targeting Camelot, a recognized lottery and gaming operator. Analysis indicates the site masquerades as Kometa Casino, a fraudulent platform designed to harvest user credentials, financial details, or distribute malware under the guise of legitimate gaming services. The threat type aligns with credential phishing and financial fraud, leveraging social engineering to exploit trust in the targeted brand. Infrastructure analysis reveals the domain kmtaswit.space was registered on October 15, 2025, through Atak Domain, a registrar frequently associated with high-risk domains. It resolves to the IP address 172.67.218.76, which may host additional malicious content. Detection metrics show minimal coverage, with only 1 of 95 security vendors flagging the domain on VirusTotal, suggesting either recent deployment or evasion techniques. The domain appears on a single security blocklist, while Gridinsoft assigns a trust score of 0/100, reinforcing its malicious classification. The page title, Kometa Casino, further confirms the impersonation of Camelot’s branding, likely to deceive users into engaging with the fraudulent service. Mitigation requires immediate blocking of the domain and its resolving IP across network security controls. Organizations should monitor for user interactions with kmtaswit.space or similar domains, particularly those mimicking gaming or lottery services. End-users should be educated on verifying domain authenticity before entering credentials, especially for platforms involving financial transactions. Security teams are advised to correlate this domain with other Atak Domain-registered sites, as the registrar’s infrastructure may harbor additional threats. Proactive threat hunting for related IPs, such as 172.67.218.76, can identify broader campaign activity. Given the domain’s offline status, continuous monitoring for reactivation or domain reuse is critical.