kelonas[.]cc

Analysis of kelonas.cc indicates a phishing domain impersonating a cryptocurrency casino under the false pretense of affiliation with Elon Musk. The domain, registered on March 7, 2026, through Gname.com Pte. Ltd., was taken offline by the time of this assessment. Infrastructure review shows it resolved to 188.114.96.3, a Cloudflare IP address located in Canada, with nameservers dave.ns.cloudflare.com and dora.ns.cloudflare.com. The SSL certificate was issued by Let's Encrypt (serial E7), a common choice for both legitimate and malicious sites.

The page title, 'Kelonas: Elon Musk’s Official Crypto Casino Powered by Blockchain,' explicitly targets users with a fabricated endorsement, aligning with the 'Brand Impersonation' scam type noted in available intelligence. Detection data reveals limited but consistent flagging: six of ninety-four security vendors on VirusTotal marked the domain as malicious, while PhishDestroy blocked it and one additional security blocklist included it. Trust scores from Scamadviser (45/100) and Gridinsoft (0/100) further support its classification as high-risk infrastructure. A Gambler Scam phishing kit was identified in use, though specific payloads or backend connections remain unconfirmed.

Defenders should treat this domain as part of a broader campaign leveraging celebrity endorsements to lure victims into fraudulent gambling schemes. While currently offline, the domain may resurface under the same or altered infrastructure. Monitoring for DNS reactivation, certificate reissuance, or new registrations with similar naming patterns (e.g., 'kelonas' variants) is recommended. No evidence links this domain to other known threat clusters at this time.