kometago[.]com

Analysis indicates that the domain kometago.com is being used for a high‑risk generic phishing campaign. The site responds with HTTP 200, suggesting an active web server that can deliver malicious pages. Threat intelligence flags the domain as active and assigns a high risk level. The domain was registered on 21 February 2026 through Dominet (HK) Limited and is hosted on nameservers expirens3.hichina.com and expirens4.hichina.com, both associated with the .cn registrar HiChina. Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious intent.

VirusTotal scans have identified the domain as suspicious in 2 out of 95 security vendors, and the domain is listed on a single security blocklist. PhishDestroy has already blocked the domain, confirming that it is recognized by at least one dedicated anti‑phishing service. The combination of a fresh registration date, low trust score, and presence on a blocklist aligns with typical characteristics of phishing infrastructure that aims to evade early detection.

While the available data confirms the domain’s role in a generic phishing operation, several aspects remain unknown. No specific phishing kit, credential‑stealing page, or targeted brand has been publicly disclosed. The limited number of VirusTotal detections suggests that the payload may be hosted on the site only intermittently or that detection signatures have not yet been updated. Consequently, the full scope of the campaign, including victim demographics and attack vectors, cannot be precisely determined at this time.

Defenders should add kometago.com to deny‑list or firewall rules and monitor DNS queries for related subdomains. Continuous observation of traffic to the identified nameservers is advised, as changes to the hosting configuration may indicate escalation. Organizations using automated URL filtering should ensure the domain is included in their blocklists, and incident response teams should be prepared to investigate any credential submissions that resolve to this domain.