kometastar[.]com

Analysis as of July 24 2026 indicates that kometastar.com is an offline domain that was used to impersonate the Camelot brand in a crypto‑gambling fraud campaign. The site was registered through NameSilo, LLC and created on 26 May 2025. Infrastructure inspection shows the domain resolves to the IP address 212.11.64.170, which belongs to AS42624 Global‑Data System IT Corporation and is geolocated in Switzerland. The domain is served by Cloudflare nameservers joaquin.ns.cloudflare.com and maisie.ns.cloudflare.com, but no TLS certificate is present, meaning connections would be unencrypted.

The page title captured from the site is “Kometa Casino,” matching the “Gambler Scam” phishing kit associated with crypto gambling operations. VirusTotal scans reported three detections out of ninety‑five security vendors, and the domain appears on one external blocklist. PhishDestroy has taken the domain offline, and Gridinsoft assigns it a trust score of zero out of one hundred. The brand target is explicitly listed as Camelot, confirming a brand‑impersonation motive.

While the site is no longer reachable, the observed infrastructure—particularly the Swiss hosting, lack of SSL, and use of a known gambling‑related kit—provides actionable indicators for threat‑hunting teams. Defenders should ensure that network egress to 212.11.64.170 is blocked, add the domain and its IP to local blocklists, and monitor for any future registrations that reuse the same nameservers or kit signatures. Continuous monitoring of VirusTotal and other reputation feeds is recommended to detect re‑emergence of similar campaigns.