kelvaro[.]top

Analysis of the domain kelvaro.top indicates it was associated with a cryptocurrency scam targeting users through a Web3-themed phishing operation. The domain was registered on August 30, 2025, via Gname.com Pte. Ltd., a registrar frequently utilized for suspicious infrastructure. At the time of assessment, kelvaro.top resolved to the IP address 104.21.35.181, hosted on Cloudflare’s network (AS13335) in the United States, a common configuration for phishing sites leveraging Cloudflare’s proxy services to obscure origin servers. Nameservers aria.ns.cloudflare.com and arturo.ns.cloudflare.com further confirm Cloudflare’s involvement in the domain’s DNS resolution.

The domain’s page title, 'Web3 Deepl,' suggests an attempt to impersonate or exploit Web3-related services, though no specific brand impersonation is confirmed in the available data. No SSL certificate was detected, increasing the likelihood of interception or manipulation of user data. Detection by security vendors is limited but notable: 10 of 95 engines on VirusTotal flagged the domain as malicious, and it appears on at least one security blocklist. The domain has since been taken offline, though its prior activity and infrastructure characteristics align with known crypto scam tactics.

Defenders should treat this domain as part of a broader phishing campaign targeting cryptocurrency users. While the exact lure or payload remains unconfirmed, the combination of Cloudflare hosting, a Web3-themed title, and cryptocurrency scam classification warrants inclusion in blocklists and monitoring for related infrastructure. The absence of an SSL certificate and the use of a registrar with a history of abuse further support its classification as high-risk. Organizations should verify whether internal users accessed the domain prior to its takedown and monitor for similar domains registered through the same registrar or resolving to the same IP range.