api[.]kometalost[.]com

Analysis as of July 24 2026 indicates that the domain api.kometalost.com has been used in a crypto‑gambling phishing campaign identified as the Gambler Scam kit. The site presented the page title “Kometa Casino”, suggesting it was impersonating an online casino service to lure victims into submitting cryptocurrency credentials. The domain was registered on February 21 2026 through Hello Internet Corp and is hosted on IP address 212.11.64.170, which belongs to AS42624 Global‑Data System IT Corporation located in Switzerland. The hosting infrastructure uses the nameservers ns100.webnic.cc and ns101.webnic.cc, and the TLS certificate is identified as rating R10.

VirusTotal records show that two of ninety‑three scanning engines flagged the domain, and it appears on a single public blocklist where it is listed as blocked by PhishDestroy. The domain’s current HTTP status is offline, and the site has been taken down, but the infrastructure elements remain observable. The evidence confirms a targeted crypto gambling phishing vector, but the exact content of the landing page and any associated credential‑harvesting forms cannot be verified because the service is no longer reachable.

Defenders should continue to block the domain and its resolving IP, add the nameservers to monitoring feeds, and ensure that any email or web traffic referencing “Kometa Casino” is inspected for malicious redirection. Ongoing surveillance of the AS42624 range is advised to detect potential re‑use of the hosting resources for similar scams. Until the site is re‑hosted, the risk remains elevated due to the confirmed phishing kit and the presence on a threat blocklist.