URLQuery
3 det.
Open reportDomain security and threat intelligence
kalosfun.com
In short
PhishDestroy records kalosfun.com as a page presenting a token swap interface with trending token listings and a wallet connection prompt.
“Kalos Fun — NFT Marketplace, DEX Swap & Token Launchpad on Elysium”
- Registrar
NameSilo- Resolved IP
- 216.198.79.1Network Billing Systems · CDN
- First observed
- Nov 11, 2026
PhishDestroy assessment Critical 100/100 Evidence score
Availability Last known active Latest stored reachability observation Observed HTTP probe
Risk signals
Analysis
Critical
- Status
- Last known active
- VirusTotal
- 0 / 92
- Scam type (automated label)
- Crypto Drainer
- Hosting
- 216.198.79.1Network Billing Systems · CDN
- Registrar
- NameSilo
- OTX
- 4 community refs
- Page captures
- 4
Capture recorded with this analysis · URLScan · 2026-11-11T12:37:21Z
SHA-256: 6b407634fe41403d99f107a79bb202a87b0273d4ca55c1a6f669885347efec4f
PhishDestroy analysis, reviewed version
On 2026-11-11, kalosfun.com displayed a dark-themed trading interface. A left sidebar lists Swap, Liquidity, Trade, NFTs, Rewards, Profile, and Fate. The central panel offers a Swap/Bridge form with "YOU PAY" and "YOU GET" fields set to HYPE and USDC, plus a "Connect wallet" button. A Trending card shows 24h volume of $14.15M and token listings including MONTRA, e/acc, and POCKET with price changes, alongside a "Trade now" button. A History panel states swaps appear after connecting a wallet.
The stored VirusTotal domain result reports 0 detections out of 92 engines.
Source evidenceVirusTotal 0 / 92 · OTX 4 references 9 sources
Cloudflare Radar
Suspicious
Open reportCloudflare RadarOriginal source recordObserved: 12 fields
Observed: · Retrieved:
Report ID
4a017b80-97e6-4147-a4ce-5397a4b18c0cFinal URL
https://kalosfun.com/HTTP response
200Navigation history
- URL
- https://kalosfun.com/
- Status
- 200
DOM structure hash
84ec98991a6bb47c5ed68698996feb3b4557d6e8b9872f6d8a87592912eae7ecDocument hash
7ffce15071d30b3aa87e397871cf88a882d99c1d9557026ed490788474dbb965Domain risk categories
- Newly Seen Domains
- Security Risks
- New Domains
Cloudflare Radar rank
- Rank range
- >200000
DNS records
- Name
- kalosfun.com
- Type
- A
- Value
- 216.198.79.1
DNSSEC valid
NoIP address
127.0.1.30127.0.1.30 is not a public internet address. It is the value stored in this source record, not the site's hosting address.
Registration record
- Registrar
- NameSilo, LLC
- Registered
- Updated
- Expires
- Nameservers
- ns1.dynu.com
- ns2.dynu.com
- ns3.dynu.com
- ns4.dynu.com
Original source fields · JSON
| Uuid | 4a017b80-97e6-4147-a4ce-5397a4b18c0c |
|---|---|
| Final url | https://kalosfun.com/ |
| Status | 200 |
| History | [
{
"url": "https://kalosfun.com/",
"status": 200
}
] |
| DOM structure hash | 84ec98991a6bb47c5ed68698996feb3b4557d6e8b9872f6d8a87592912eae7ec |
| Document hash | 7ffce15071d30b3aa87e397871cf88a882d99c1d9557026ed490788474dbb965 |
| Domain risks | [
"Newly Seen Domains",
"Security Risks",
"New Domains"
] |
| Radar rank | {
"bucket": ">200000"
} |
| DNS records | [
{
"name": "kalosfun.com",
"type": "A",
"value": "216.198.79.1"
}
] |
| Dnssec valid | false |
| Ip | 127.0.1.30 127.0.1.30 is not a public internet address. It is the value stored in this source record, not the site's hosting address. |
| Registration record | {
"registrar": "NameSilo, LLC",
"created": "2026-11-09T16:24:11Z",
"updated": "2026-11-11T11:25:07Z",
"expires": "2027-11-09T16:24:11Z",
"nameservers": [
"ns1.dynu.com",
"ns2.dynu.com",
"ns3.dynu.com",
"ns4.dynu.com"
]
} |
URLScan
Malicious
SHA-256 cdd0c0d2c46f13b550314b12bae94700497be3beee8b96fb56bbf9e3c9bae0f2
URLScanOriginal source recordObserved: 22 fields
Observed: · Retrieved:
Report ID
01a1ca9c-aa60-7529-a2e3-9567d845d94aFinal URL
https://kalosfun.com/HTTP response
200IP address
216.198.79.1Contacted domains
- kalos-test-trade.onrender.com
- media.kalos.fun
- api.kalos.fun
Contacted IP addresses
- 216.24.57.18
- 216.24.57.16
- 2a06:98c1:3120::3
- 216.198.79.1
Autonomous systems (ASN)
- 397273
- 13335
- 16509
Server countries
- US
Linked domains
- elysium.kinetiq.xyz
- x.com
Social media links
- https://x.com/kalosfun
Document hash
7ffce15071d30b3aa87e397871cf88a882d99c1d9557026ed490788474dbb965Script hashes
- 498d5358bc0dc7ad431a5e559e0de9250226c39254f5fae0a38e975ff81b76e7
- df61dba705a1a33d78e2cc8fc5c17f5e578fe53fac20e341c8f58da00991a233
- c44509f63206264f1b8cffa08a2fde50a5e65eb74ba45ac26e70901d418e1e08
- 43605634dc67fea4652801b22a552d6ea4ad427800800100e268812cfb116bd9
- 370e8b5da891364242e41ed61e6f5910fa69b143ad5d2580d9816cdaa0691afc
- f4ba1ef4831c046171151f2c007e6213baf69db5b7fc1cd18702962a4b10042b
- c5603cc7208fd0bdc273d2fc0237b7d9c2d05891ea60b1a808a3cc890d630627
- 38d3ddbdda9168d1712f3909af9da68b87930111d120b9576f72ec5fb02ca702
- 2aa0412b26021ef4a4146ad8d3211e61a88259f7d66d9462db064b683ce7ec5f
- ae096aaaa24705169564592cb54e6e4495cdf4712696f9d7f1dbf637be7814da
JavaScript globals
- __kalosSniperOpen
- kalosSyncSeoMeta
- kalosLoadingKind
- kalosSyncLoadingRoute
- q
- h
- p
- n
- KalosHeaderCache
- kalosLoadingMark
- Motion
- isAmount
- marketAmount
- exactAmount
- formatCount
- plural
- timeAgo
- rowTime
- formatPct
- KalosToasts
- Kit
- addRouteView
- legacyRoute
- routeSwapOff
- kalosSocialOn
- routeFromPath
- routeHref
- personProfile
- personName
- personTitle
- personRoute
- personTeamBadge
- installPersonTeamTooltip
- personPhotoUrl
- personGradientSeed
- personOklchRgb
- personColorFlaws
- personGradientColors
- personGradientStyle
- personGradient
Browser storage keys
- kalos-swap-arrange-v1
- kalos-arrange-hint
- kalos-api-health-v1:https://kalosfun.com/kapi
- kalos-api-trust-v1:https://kalosfun.com/kapi
- kalos-token-logos-v1:99901:https://kalosfun.com/kapi
- kalos-mini-history-v1:1no5wtl|native|hype|1D
- kalos-mini-history-v1:index
- kalos-mini-history-v1:1no5wtl|0xb47c4c8f73f009cc0c0d3f92b388d13e293f0b65|0xbce6c
- kalos-last-v1:99901:https://kalosfun.com/kapi
TLS session and certificate
- Subject alternative names
- *.kalosfun.com
- kalosfun.com
- Cipher
- AES_128_GCM
- Issuer
- YR2
- Subject
- *.kalosfun.com
- Protocol
- TLS 1.3
- Valid until
- Valid from
Domain age, days
1Registered domain age, days
1Certificate age, days
1Certificate validity, days
89Page requests
205Provider verdicts
- Engine verdict
- Tags
- urlscan-ml
- urlscan-ml-2aab354
- Score
- 99
- Malicious
- Yes
- Overall verdict
- Tags
- phishing
- Score
- 100
- Brands
- genericcrypto
- Malicious
- Yes
- Categories
- phishing
- URLScan verdict
- Tags
- phishing
- Score
- 100
- Brands
- Generic Crypto
- Malicious
- Yes
- Categories
- phishing
HTTP headers
- Server
- Vercel
- Content-type
- text/html; charset=utf-8
- Strict-transport-security
- max-age=63072000
Original source fields · JSON
| Uuid | 01a1ca9c-aa60-7529-a2e3-9567d845d94a |
|---|---|
| Final url | https://kalosfun.com/ |
| Status | 200 |
| Ip | 216.198.79.1 |
| Contacted domains | [
"kalos-test-trade.onrender.com",
"media.kalos.fun",
"api.kalos.fun"
] |
| Contacted IP addresses | [
"216.24.57.18",
"216.24.57.16",
"2a06:98c1:3120::3",
"216.198.79.1"
] |
| Asns | [
"397273",
"13335",
"16509"
] |
| Countries | [
"US"
] |
| Linked domains | [
"elysium.kinetiq.xyz",
"x.com"
] |
| Social | [
"https://x.com/kalosfun"
] |
| Document hash | 7ffce15071d30b3aa87e397871cf88a882d99c1d9557026ed490788474dbb965 |
| Script hashes | [
"498d5358bc0dc7ad431a5e559e0de9250226c39254f5fae0a38e975ff81b76e7",
"df61dba705a1a33d78e2cc8fc5c17f5e578fe53fac20e341c8f58da00991a233",
"c44509f63206264f1b8cffa08a2fde50a5e65eb74ba45ac26e70901d418e1e08",
"43605634dc67fea4652801b22a552d6ea4ad427800800100e268812cfb116bd9",
"370e8b5da891364242e41ed61e6f5910fa69b143ad5d2580d9816cdaa0691afc",
"f4ba1ef4831c046171151f2c007e6213baf69db5b7fc1cd18702962a4b10042b",
"c5603cc7208fd0bdc273d2fc0237b7d9c2d05891ea60b1a808a3cc890d630627",
"38d3ddbdda9168d1712f3909af9da68b87930111d120b9576f72ec5fb02ca702",
"2aa0412b26021ef4a4146ad8d3211e61a88259f7d66d9462db064b683ce7ec5f",
"ae096aaaa24705169564592cb54e6e4495cdf4712696f9d7f1dbf637be7814da"
] |
| Globals | [
"__kalosSniperOpen",
"kalosSyncSeoMeta",
"kalosLoadingKind",
"kalosSyncLoadingRoute",
"q",
"h",
"p",
"n",
"KalosHeaderCache",
"kalosLoadingMark",
"Motion",
"isAmount",
"marketAmount",
"exactAmount",
"formatCount",
"plural",
"timeAgo",
"rowTime",
"formatPct",
"KalosToasts",
"Kit",
"addRouteView",
"legacyRoute",
"routeSwapOff",
"kalosSocialOn",
"routeFromPath",
"routeHref",
"personProfile",
"personName",
"personTitle",
"personRoute",
"personTeamBadge",
"installPersonTeamTooltip",
"personPhotoUrl",
"personGradientSeed",
"personOklchRgb",
"personColorFlaws",
"personGradientColors",
"personGradientStyle",
"personGradient"
] |
| Storage keys | [
"kalos-swap-arrange-v1",
"kalos-arrange-hint",
"kalos-api-health-v1:https://kalosfun.com/kapi",
"kalos-api-trust-v1:https://kalosfun.com/kapi",
"kalos-token-logos-v1:99901:https://kalosfun.com/kapi",
"kalos-mini-history-v1:1no5wtl|native|hype|1D",
"kalos-mini-history-v1:index",
"kalos-mini-history-v1:1no5wtl|0xb47c4c8f73f009cc0c0d3f92b388d13e293f0b65|0xbce6c",
"kalos-last-v1:99901:https://kalosfun.com/kapi"
] |
| Tls | {
"san": [
"*.kalosfun.com",
"kalosfun.com"
],
"cipher": "AES_128_GCM",
"issuer": "YR2",
"subject": "*.kalosfun.com",
"protocol": "TLS 1.3",
"valid_to": "2027-02-07T16:01:16Z",
"valid_from": "2026-11-09T16:01:17Z"
} |
| Domain age days | 1 |
| Apex age days | 1 |
| Tls age days | 1 |
| Tls valid days | 89 |
| Requests | 205 |
| Provider verdicts | {
"engines": {
"tags": [
"urlscan-ml",
"urlscan-ml-2aab354"
],
"score": 99,
"malicious": true
},
"overall": {
"tags": [
"phishing"
],
"score": 100,
"brands": [
"genericcrypto"
],
"malicious": true,
"categories": [
"phishing"
]
},
"urlscan": {
"tags": [
"phishing"
],
"score": 100,
"brands": [
"Generic Crypto"
],
"malicious": true,
"categories": [
"phishing"
]
}
} |
| HTTP headers | {
"server": "Vercel",
"content-type": "text/html; charset=utf-8",
"strict-transport-security": "max-age=63072000"
} |
Separate monitor record · 2026-11-12 04:30 UTC
Separate stored monitor snapshot; does not replace the primary report record or establish current availability.
- record_source
- domain_monitor.urlscan
- uuid
- 01a1ca9c-aa60-7529-a2e3-9567d845d94a
- score
- 100
- malicious
- true
- result_at
- 2026-11-12T04:30:21Z
- enriched_at
- null
- source_timestamps
- {"urlscan_result_at":"2026-11-12 05:30:21","urlscan_enriched_at":null}
- timestamp_basis
- Europe/Berlin, as used by the existing report; source timestamps are retained verbatim
VirusTotal
0 / 92 engine detections
Analysis:
Open report VirusTotalOriginal source recordObserved: 13 fields
Observed: · Retrieved:
Vendor result counts
- Timeout
- 0
- Harmless
- 0
- Malicious
- 0
- Suspicious
- 0
- Undetected
- 92
Reputation score
0Registrar
NameSilo, LLCCreated
Expires
Updated
First seen
DNS records
- TTL, seconds
- 3600
- Type
- NS
- Value
- ns6.dynu.com
- TTL, seconds
- 3600
- Type
- NS
- Value
- ns2.dynu.com
- TTL, seconds
- 3600
- Type
- NS
- Value
- ns3.dynu.com
- TTL, seconds
- 3600
- Type
- NS
- Value
- ns4.dynu.com
- TTL, seconds
- 120
- Type
- A
- Value
- 216.198.79.1
- TTL, seconds
- 3600
- Type
- NS
- Value
- ns5.dynu.com
- TTL, seconds
- 3600
- Type
- NS
- Value
- ns1.dynu.com
- TTL, seconds
- 3600
- Type
- SOA
- Responsible mailbox
- administrator.dynu.com
- Value
- ns1.dynu.com
DNS records observed
JARM fingerprint
3fd3fd00000000000043d43d00043dc3b2afa8a5ec09b510a8559aff7899fbCertificate
- Subject alternative names
- *.kalosfun.com
- kalosfun.com
- Issuer
- Let's Encrypt / YR2
- Serial
- 6b09efdff89242c0d969368614a03a519e8
- SHA-256
- ce68ce287e4df262078f7122c33a37682f4bfbe9e93da1f8e21e7ac8a751dc2f
- Subject
- *.kalosfun.com
- Valid until
- Valid from
- Observed at
Registration record
- Registrar
- NameSilo, LLC
- Registrar IANA ID
- 1479
- Registrar URL
- http://www.namesilo.com
- Registered
- Updated
- Expires
- Status
- clientTransferProhibited
- Nameservers
- ns1.dynu.com
- ns2.dynu.com
- ns3.dynu.com
- ns4.dynu.com
- DNSSEC
- unsigned
Registry data (RDAP)
- Status
- client transfer prohibited
- Registry events
- Last changed
- Registration
- Registrar expiration
- Last RDAP database update
Original source fields · JSON
| Vendor result counts | {
"timeout": 0,
"harmless": 0,
"malicious": 0,
"suspicious": 0,
"undetected": 92
} |
|---|---|
| Reputation | 0 |
| Registrar | NameSilo, LLC |
| Created | 2026-11-09T16:24:11Z |
| Expires | 2027-11-09T16:24:11Z |
| Updated | 2026-11-11T11:25:07Z |
| First seen | 2026-11-11T12:32:35Z |
| DNS records | [
{
"ttl": 3600,
"type": "NS",
"value": "ns6.dynu.com"
},
{
"ttl": 3600,
"type": "NS",
"value": "ns2.dynu.com"
},
{
"ttl": 3600,
"type": "NS",
"value": "ns3.dynu.com"
},
{
"ttl": 3600,
"type": "NS",
"value": "ns4.dynu.com"
},
{
"ttl": 120,
"type": "A",
"value": "216.198.79.1"
},
{
"ttl": 3600,
"type": "NS",
"value": "ns5.dynu.com"
},
{
"ttl": 3600,
"type": "NS",
"value": "ns1.dynu.com"
},
{
"ttl": 3600,
"type": "SOA",
"rname": "administrator.dynu.com",
"value": "ns1.dynu.com"
}
] |
| Dns at | 2026-11-11T12:32:35Z |
| Jarm | 3fd3fd00000000000043d43d00043dc3b2afa8a5ec09b510a8559aff7899fb |
| Certificate | {
"san": [
"*.kalosfun.com",
"kalosfun.com"
],
"issuer": "Let's Encrypt / YR2",
"serial": "6b09efdff89242c0d969368614a03a519e8",
"sha256": "ce68ce287e4df262078f7122c33a37682f4bfbe9e93da1f8e21e7ac8a751dc2f",
"subject": "*.kalosfun.com",
"valid_to": "2027-02-07T16:01:16Z",
"valid_from": "2026-11-09T16:01:17Z",
"observed_at": "2026-11-11T12:32:35Z"
} |
| Registration record | {
"registrar": "NameSilo, LLC",
"registrar_iana_id": "1479",
"registrar_url": "http://www.namesilo.com",
"created": "2026-11-09T16:24:11Z",
"updated": "2026-11-11T11:25:07Z",
"expires": "2027-11-09T16:24:11Z",
"status": [
"clientTransferProhibited"
],
"nameservers": [
"ns1.dynu.com",
"ns2.dynu.com",
"ns3.dynu.com",
"ns4.dynu.com"
],
"dnssec": "unsigned"
} |
| Registry data | {
"status": [
"client transfer prohibited"
],
"events": {
"last changed": "2026-11-10T00:12:46Z",
"registration": "2026-11-09T00:00:00Z",
"registrar expiration": "2027-11-09T00:00:00Z",
"last update of RDAP database": "2026-11-11T12:32:35Z"
}
} |
Separate collector summary
This is a separate stored result. Its counts, vendors and dates do not replace the provider observation above. A retrieval date is not an analysis date.
- source
- VirusTotal
- scope
- unknown
- result_state
- observed
- numerator
- 0
- denominator
- 92
- malicious
- null
- suspicious
- null
- vendors
- []
- observed_at
- 2026-11-11 12:32:23
- checked_at
- 2026-11-11 14:10:05
- fetched_at
- 2026-11-11 13:10:06
- time_basis
- as stored; legacy timezone not established
OTX
4 community references
Open reportGoogle Safe Browsing
No threat flag
Open reportSpamhaus DBL
Check recorded; verdict not retained
Open reportPhishDestroy DOM
100 / 100 · heuristic score · 3 brand references · 1 classification
Open reportSeparate monitor score · 100 / 100 · 2026-11-11T13:15:06Z
This dated monitor analysis is separate from the primary PhishDestroy analysis above. A heuristic score is not a measured probability.
- record_source
- domain_monitor.dom_analysis
- heuristic_score
- 100
- analyzed_at
- 2026-11-11T13:15:06Z
- source_timestamp
- 2026-11-11 14:15:06
- timestamp_basis
- Europe/Berlin, as used by the existing report; source timestamps are retained verbatim
PhishDestroy narrative
Narrative generation metadata
Open reportTitle, description and generation record
The narrative generation date is separate from observation dates. These are the retained publication fields, not an additional independent detection.
- ai_title
- kalosfun.com — Recorded swap interface with trending token panel
- ai_description
- PhishDestroy records kalosfun.com as a page presenting a token swap interface with trending token listings and a wallet connection prompt.
- ai_summary
- On 2026-11-11, kalosfun.com displayed a dark-themed trading interface. A left sidebar lists Swap, Liquidity, Trade, NFTs, Rewards, Profile, and Fate. The central panel offers a Swap/Bridge form with "YOU PAY" and "YOU GET" fields set to HYPE and USDC, plus a "Connect wallet" button. A Trending card shows 24h volume of $14.15M and token listings including MONTRA, e/acc, and POCKET with price changes, alongside a "Trade now" button. A History panel states swaps appear after connecting a wallet. The stored VirusTotal domain result reports 0 detections out of 92 engines.
- ai_generated_by
- threat-v6-mimo
- ai_generated_at
- 2026-11-11 14:13:05
- revision
- 6e09bc2f5390a51320e1fa4e3ebdec14b82e86df83cb2311059a1b5a5b62aa9e
- mode
- reviewed
- interpretation
- Selected public package; text generation time is separate from source observation dates.
Results reflect each source’s collection time. Zero detections do not guarantee safety. OTX references are community publications.
Collected source details
Stored page, network and scanner observations, grouped by source and observation time.
Every stored field, with its source and date
Website checksOriginal source recordRetrieved: 25 fields
Mail configuration
- SPF lookups
- 0
Protective DNS results
- Resolvers checked
- 12
- Blocking resolvers
- 0
Web archive observations
- Last observation
- First observation
- Recorded changes
- 0
- Archived days
- 1
- Average page size, bytes
- 32243
Crawler rules
- User agents
- *
- Present
- Yes
- Sitemap URLs
- https://kalosfun.com/sitemap.xml
Sitemap
- Present
- Yes
- URL count
- 18
Page title and metadata
- Open Graph URL
- https://kalosfun.com/
- Page title
- Kalos Fun — NFT Marketplace, DEX Swap & Token Launchpad on Elysium
- Author
- Kalos Fun
- Open Graph type
- website
- Indexing directives
- index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1
- Open Graph image
- https://kalosfun.com/assets/og/kalos-card.jpg
- Open Graph title
- Kalos Fun — NFT Marketplace, DEX Swap & Token Launchpad on Elysium
- Keywords
- Kalos Fun, Kalos, kalosfun, kalosfun.com, Kalos Fun Marketplace, Kalos NFT Marketplace, Kalos DEX, Kalos Swap, Kalos Drops, Kalos Launchpad, Kalos Fate, Kalos Rewards, Kalos Sniper, Elysium NFT, Kinetiq Elysium, Hyperliquid NFT, Web3 Marketplace
- Open Graph site name
- Kalos Fun
- Theme color
- #171717
- Description
- Kalos Fun (kalosfun.com) is the premier NFT Marketplace, DEX Swap, Token Launchpad, and Fate ecosystem on Kinetiq Elysium. Discover collections, trade NFTs, swap tokens, and earn rewards on Kalos Fun.
- Twitter card
- summary_large_image
- Twitter account
- @kalosfun
- Canonical URL
- https://kalosfun.com/
- Open Graph description
- Kalos Fun is the all-in-one NFT marketplace, decentralized exchange (DEX), token sniper, and launchpad on Kinetiq Elysium. Discover collections, trade NFTs, swap tokens, and earn rewards.
- Twitter Creator
- @kalosfun
Trackers
- Requests
- 119
Forms and mixed content
- Third-party scripts
- 0
HTTP response
- Reachable
- Yes
- HTTP status
- 200
- Request timings, ms
- DNS
- 272
- TLS
- 13
- Waiting
- 26
- Connection
- 8
- Download
- 11
- Response time, ms
- 330
TLS connection
- ALPN
- h2
- Cipher
- TLS_AES_128_GCM_SHA256
- Protocol
- TLSv1.3
- Supported versions
- TLSv1.2
- TLSv1.3
- Certificate authorized
- Yes
- Forward secrecy
- Yes
Carbon estimate
- Bytes
- 179284
- CO₂, grams
- 0.0066
- Cleaner than, %
- 9
DNS servers
- Nameservers
- IP address
- 162.251.164.146
- Host
- ns3.dynu.com
- IP address
- 108.181.13.234
- Host
- ns2.dynu.com
- IP address
- 108.181.159.122
- Host
- ns4.dynu.com
- IP address
- 216.105.169.98
- Host
- ns5.dynu.com
- IP address
- 72.51.58.2
- Host
- ns1.dynu.com
- IP address
- 173.0.55.138
- Host
- ns6.dynu.com
- DNS zone
- kalosfun.com
Location
- IP address
- 216.198.79.1
- ASN
- 16509
- Organization
- Network Billing Systems
- City
- Atlanta
- Country
- US
TLS certificate
- Issuer
- Let's Encrypt / YR2
- Subject
- *.kalosfun.com
DNS records
- A
- 216.198.79.1
- NS
- ns3.dynu.com
- ns2.dynu.com
- ns1.dynu.com
- ns6.dynu.com
- ns5.dynu.com
- ns4.dynu.com
- SOA
- Primary nameserver
- ns1.dynu.com
- Hostmaster
- administrator.dynu.com
- Serial
- 5
- Refresh, seconds
- 3600
- Retry, seconds
- 900
- Expiry, seconds
- 604800
- Minimum TTL, seconds
- 300
DNSSEC
- DS record
- No
- RRSIG
- No
- DNSKEY
- No
HSTS
- Header value
- max-age=63072000
- Observation
- HSTS header does not include all subdomains.
HTTP security policies
- X-Frame-Options
- No
- Referrer-Policy
- No
- X-XSS-Protection
- No
- Permissions-Policy
- No
- X-Content-Type-Options
- No
- Content-Security-Policy
- No
- Strict-Transport-Security
- max-age=63072000
- Cross-Origin-Opener-Policy
- No
- Cross-Origin-Embedder-Policy
- No
- Cross-Origin-Resource-Policy
- No
IP lookup
- IP address
- 216.198.79.1
- IP version
- 4
Redirects
- Redirect chain
- https://kalosfun.com
Technology stack
- Technologies
- Vercel
- Priority Hints
- HSTS
- PWA
- Open Graph
Social profiles
- Profiles
- https://x.com/kalosfun
Page links
- External link addresses
- https://elysium.kinetiq.xyz/testnet-faucet
- https://x.com/kalosfun
- https://elysium.kinetiq.xyz/testnet-explorer
- External links
- 3
- Internal links
- 11
Registration record
- Registrar
- NameSilo, LLC
- Registered
- Updated
- Expires
- Status
- clientTransferProhibited https://icann.org/epp
- Nameservers
- ns1.dynu.com
- ns2.dynu.com
- ns3.dynu.com
- ns4.dynu.com
HTTP headers
- Response headers
- Server
- Vercel
- Content-type
- text/html; charset=utf-8
- Strict-transport-security
- max-age=63072000
Original source fields · JSON
| Mail configuration | {
"spf_lookups": 0
} |
|---|---|
| Protective DNS results | {
"resolvers": 12,
"blocked_count": 0
} |
| Web archive observations | {
"last": "2026-11-11T12:47:44Z",
"first": "2026-11-11T12:47:44Z",
"changes": 0,
"days_archived": 1,
"avg_page_bytes": 32243
} |
| Crawler rules | {
"agents": [
"*"
],
"present": true,
"sitemaps": [
"https://kalosfun.com/sitemap.xml"
]
} |
| Sitemap | {
"present": true,
"url_count": 18
} |
| Page title and metadata | {
"ogUrl": "https://kalosfun.com/",
"title": "Kalos Fun — NFT Marketplace, DEX Swap & Token Launchpad on Elysium",
"author": "Kalos Fun",
"ogType": "website",
"robots": "index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1",
"ogImage": "https://kalosfun.com/assets/og/kalos-card.jpg",
"ogTitle": "Kalos Fun — NFT Marketplace, DEX Swap & Token Launchpad on Elysium",
"keywords": "Kalos Fun, Kalos, kalosfun, kalosfun.com, Kalos Fun Marketplace, Kalos NFT Marketplace, Kalos DEX, Kalos Swap, Kalos Drops, Kalos Launchpad, Kalos Fate, Kalos Rewards, Kalos Sniper, Elysium NFT, Kinetiq Elysium, Hyperliquid NFT, Web3 Marketplace",
"ogSiteName": "Kalos Fun",
"themeColor": "#171717",
"description": "Kalos Fun (kalosfun.com) is the premier NFT Marketplace, DEX Swap, Token Launchpad, and Fate ecosystem on Kinetiq Elysium. Discover collections, trade NFTs, swap tokens, and earn rewards on Kalos Fun.",
"twitterCard": "summary_large_image",
"twitterSite": "@kalosfun",
"canonicalUrl": "https://kalosfun.com/",
"ogDescription": "Kalos Fun is the all-in-one NFT marketplace, decentralized exchange (DEX), token sniper, and launchpad on Kinetiq Elysium. Discover collections, trade NFTs, swap tokens, and earn rewards.",
"twitterCreator": "@kalosfun"
} |
| Trackers | {
"requests": 119
} |
| Forms and mixed content | {
"third_party_scripts": 0
} |
| Status | {
"up": true,
"code": 200,
"timings": {
"dns": 272,
"tls": 13,
"wait": 26,
"connect": 8,
"download": 11
},
"response_ms": 330
} |
| TLS connection | {
"alpn": "h2",
"cipher": "TLS_AES_128_GCM_SHA256",
"protocol": "TLSv1.3",
"versions": [
"TLSv1.2",
"TLSv1.3"
],
"authorized": true,
"forward_secrecy": true
} |
| Carbon | {
"bytes": 179284,
"co2_grams": 0.0066,
"cleaner_than": 9
} |
| Dns server | {
"ns": [
{
"ip": "162.251.164.146",
"host": "ns3.dynu.com"
},
{
"ip": "108.181.13.234",
"host": "ns2.dynu.com"
},
{
"ip": "108.181.159.122",
"host": "ns4.dynu.com"
},
{
"ip": "216.105.169.98",
"host": "ns5.dynu.com"
},
{
"ip": "72.51.58.2",
"host": "ns1.dynu.com"
},
{
"ip": "173.0.55.138",
"host": "ns6.dynu.com"
}
],
"zone": "kalosfun.com"
} |
| Location | {
"ip": "216.198.79.1",
"asn": "16509",
"org": "Network Billing Systems",
"city": "Atlanta",
"country": "US"
} |
| Ssl | {
"issuer": "Let's Encrypt / YR2",
"subject": "*.kalosfun.com"
} |
| DNS records | {
"A": [
"216.198.79.1"
],
"NS": [
"ns3.dynu.com",
"ns2.dynu.com",
"ns1.dynu.com",
"ns6.dynu.com",
"ns5.dynu.com",
"ns4.dynu.com"
],
"SOA": "{\"nsname\": \"ns1.dynu.com\", \"hostmaster\": \"administrator.dynu.com\", \"serial\": 5, \"refresh\": 3600, \"retry\": 900, \"expire\": 604800, \"minttl\": 300}"
} |
| Dnssec | {
"ds": false,
"rrsig": false,
"dnskey": false
} |
| Hsts | {
"header": "max-age=63072000",
"message": "HSTS header does not include all subdomains."
} |
| HTTP security policies | {
"xFrameOptions": false,
"referrerPolicy": false,
"xXSSProtection": false,
"permissionsPolicy": false,
"xContentTypeOptions": false,
"contentSecurityPolicy": false,
"strictTransportPolicy": "max-age=63072000",
"crossOriginOpenerPolicy": false,
"crossOriginEmbedderPolicy": false,
"crossOriginResourcePolicy": false
} |
| Get ip | {
"ip": "216.198.79.1",
"family": 4
} |
| Redirects | {
"chain": [
"https://kalosfun.com"
]
} |
| Tech stack | {
"technologies": [
"Vercel",
"Priority Hints",
"HSTS",
"PWA",
"Open Graph"
]
} |
| Social profiles | {
"profiles": [
"https://x.com/kalosfun"
]
} |
| Page links | {
"external": [
"https://elysium.kinetiq.xyz/testnet-faucet",
"https://x.com/kalosfun",
"https://elysium.kinetiq.xyz/testnet-explorer"
],
"external_count": 3,
"internal_count": 11
} |
| Registration record | {
"registrar": "NameSilo, LLC",
"created": "2026-11-09T16:24:11Z",
"updated": "2026-11-11T11:25:07Z",
"expires": "2027-11-09T16:24:11Z",
"status": [
"clientTransferProhibited https://icann.org/epp"
],
"nameservers": [
"ns1.dynu.com",
"ns2.dynu.com",
"ns3.dynu.com",
"ns4.dynu.com"
]
} |
| HTTP headers | {
"headers": {
"server": "Vercel",
"content-type": "text/html; charset=utf-8",
"strict-transport-security": "max-age=63072000"
}
} |
Network Security Intelligence Registrar context
Registrar context NameSilo
Stored registration data identifies NameSilo as the registrar. PhishDestroy maintains separate registrar investigations; that broader material is contextual and is not an independent detection for this domain.
Explore
Extracted from stored page analysis
11 wallet · 0 Telegram Observed indicators
Full extracted values, their blockchain and collection source. An address found in page content does not establish who controls it.
ETH
0x063f7cc5339f92a5fd7baf3d22233044fda1f327Format validated · Domain analysis ETH
0x0f79931689af199e7cf868ed1107bba2c83c68f7Format validated · Domain analysis ETH
0x5c5a1106a4e2a9ca5fadab22d6a7dbed89a11bdaFormat validated · Domain analysis ETH
0x63bfc3eb19629a9a968bfed6dd76c2d0adf09696Format validated · Domain analysis ETH
0x74954541bbfeb66c7b0650da1b43a0e3d387168cFormat validated · Domain analysis ETH
0x8df4f39d592de2aaee15838b265c2392d19a4128Format validated · Domain analysis ETH
0x98587c314b67742643561d077b14d2023c7676beFormat validated · Domain analysis ETH
0xa3c1d6a8648df3978a38ce1478fbc284c75d95d7Format validated · Domain analysis ETH
0xb47c4c8f73f009cc0c0d3f92b388d13e293f0b65Format validated · Domain analysis ETH
0xbce6ce62ef0bad529e5674a64fb23ce79df70e67Format validated · Domain analysis ETH
0xf0394d1e25be152c9746791f5da3b287743f0e52Format validated · Domain analysisIoC extraction recorded 2026-11-12 05:00:17 UTC
Blocklist matchesPhishDestroy · no match in the other 11 1
PhishDestroy PhishDestroy list View source
Checked, no match
Last checked
Stored Capture · 4 captures
6b407634fe41403d99f107a79bb202a87b0273d4ca55c1a6f669885347efec4f SHA-256 of the prepared copy given to the model: ca2685971982db17c028cf3b048cea53ad3bb33a352e5cf17d2140a26069fbfd All capture links and hashes (4)
- URLScan · 2026-11-11 · 2026-11-11 12:37 UTC · Source report
SHA-256:6b407634fe41403d99f107a79bb202a87b0273d4ca55c1a6f669885347efec4f· 43044 bytes - Stored capture · Capture time unavailable
- Cloudflare Radar · 2026-11-11 13:11 UTC · Source report
SHA-256:2cdc3b2dcad1f5e6be96f49f0700045152a0b34f5b53ccad36dd439c96f0f629· 122927 bytes - URLQuery · Capture time unavailable · Source report
SHA-256:c0ce746f1cba9450f0713cc1627bc2d4638158830d38b0c00604b94788ab7d70· 102182 bytes
Domain details
Domain
URLScan verdict Malicious score 100 Phishing report ↗
Observed indicators11 wallet · 0 Telegram — full values ↗
IP Context 216.198.79.1 Vercel shared edge origin IP hidden Edge-IP reputation is not attributed to this domain.
216.198.79.1 Vercel shared edge origin IP hidden Edge-IP reputation is not attributed to this domain. OTX tags
Registrar NameSilo (US) PhishDestroy Investigation
(US) PhishDestroy Investigation RegistrationExpires Nov 9, 2027
WHOIS statusclientTransferProhibited
HTTP Status200
LLM Report Plain-text dossier structured for AI agents
Technical detailsProvenance & timestamps
First DetectedNov 11, 2026
DOM Analysis
IoC Extraction
Submitted URLhttps://kalosfun.com/
Favicon Hash
Case ID
Network & certificates
Stored technical evidenceNetwork & DNS
Shared CDN edge- Resolved IP
- 216.198.79.1
- Network ASN
- AS16509
- Organization
- Network Billing Systems
- Observed location
- Atlanta, US
- Server header
- Vercel
Edge-IP reputation is not attributed to this domain.
Nameservers 6
ns1.dynu.comns2.dynu.comns3.dynu.comns4.dynu.comns5.dynu.comns6.dynu.com
SOA
nsname: ns1.dynu.comhostmaster: administrator.dynu.comserial: 5refresh: 3600retry: 900expire: 604800minttl: 300
Registrar abuse contact VirusTotal WHOIS
Location describes the IP network.
TLS certificate
- Issuer
- YR2
- Valid from
- 2026-11-09 16:01:17
- Valid until
- 2027-02-07 16:01:16
- Hostname coverage
- Stored certificate dates valid
- Validity
- Within stored validity dates
- Collection source
- PhishDestroy collector
Certificate names · 2 SANs
*.kalosfun.comkalosfun.com
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Recorded subdomains1
Hostnames retained in the domain record or Certificate Transparency cache. A hostname alone does not establish current availability or malicious activity.
www.kalosfun.comDomain record
Technologies · 5 identified
V
Vercel
PaaS
R
Render
PaaS
M
math.js
JavaScript libraries
HSTS
HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.
Security
Cloudflare
Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.
CDN
Detected via Cloudflare Radar · Wappalyzer engine
Report This Domain Submit evidence & help protect others
Archived Evidence
Wayback Machine Snapshot
Stored Capture Evidence 1 snapshot
Timestamped response metadata retained by the local collection pipeline. Each value below belongs to the displayed archive time.
Archived HTTP response HTTP 200
Requested URL:
https://kalosfun.com/Kalos Fun — NFT Marketplace, DEX Swap & Token Launchpad on Elysium
Kalos Fun (kalosfun.com) is the premier NFT Marketplace, DEX Swap, Token Launchpad, and Fate ecosystem on Kinetiq Elysium. Discover collections, trade NFTs, swap tokens, and earn rewards on Kalos Fun.
Response
HTTP 200
HTTP 200
HTML body
175.1 KB
175.1 KB
Compressed
30.0 KB
30.0 KB
Links
26 internal · 5 external
26 internal · 5 external
Detected technologies
bootstrap
Selected response headers
Cache-Control: public, max-age=0, must-revalidateContent-Encoding: gzipContent-Type: text/html; charset=utf-8Server: VercelSecurity headers present
Strict-Transport-Security
HSTS: observed DNSSEC: not observed WAF / firewall: not observed Cloaking flag: not observed
Favicon fingerprint:
fdc68d3559e7204365f30f97f706530650020e526342498dbfd6d0feb6445b82Open Graph title: Kalos Fun — NFT Marketplace, DEX Swap & Token Launchpad on Elysium
Open Graph description: Kalos Fun is the all-in-one NFT marketplace, decentralized exchange (DEX), token sniper, and launchpad on Kinetiq Elysium. Discover collections, trade NFTs, swap tokens, and earn rewards.
Twitter card:
summary_large_imageSaved response-header values · 16
- Access-Control-Allow-Headers
*- Access-Control-Allow-Methods
GET, POST, OPTIONS, PUT, DELETE- Access-Control-Allow-Origin
*- Age
102234- Cache-Control
public, max-age=0, must-revalidate- Content-Disposition
inline- Content-Encoding
gzip- Content-Type
text/html; charset=utf-8- Date
Wed, 11 Nov 2026 12:39:21 GMT- Etag
W/"167d6658bcbe89e6d05e99b8449467c1"- Last-Modified
Tue, 10 Nov 2026 08:15:26 GMT- Server
Vercel- Strict-Transport-Security
max-age=63072000- Transfer-Encoding
chunked- X-Vercel-Cache
HIT- X-Vercel-Id
fra1::s7kc6-1794400761642-c06961aa9744
Values retained by the collector; long values may be shortened during collection.
Registration & observation details1
Availability observations
- Last reachable observation
An estimated time describes an observation window. It does not prove a registrar action or the exact moment a site became unavailable.
All stored data112
Detections & threat intelligence
- VirusTotal detections
- 0
- VirusTotal checked at
- 2026-11-11 14:10:05
- Safe Browsing flagged
- No
- Safe Browsing checked at
- 2026-11-11 14:10:07
- Blocklist hits
- PhishDestroy
- Blocklist count
- 1
- Blocklist checked at
- 2026-11-12 04:20:02
- Drainer checked at
- 2026-11-11 14:15:06
- URLScan ID
- 01a1ca9c-aa60-7529-a2e3-9567d845d94a
- Case ID
- PD-C9533574308C30B0C875
- Report count
- 1
- User reports
- 0
- Report status
- sent
- URLScan checked at
- 2026-11-11 13:38:41
- URLQuery detections
- 3
- URLQuery DOM hash
- domhasha04cfeb9711288308291614722eb0f77
- Cloudflare radar URL
- https://radar.cloudflare.com/scan/4a017b80-97e6-4147-a4ce-5397a4b18c0c
- OTX pulses
- 4
- OTX malware
- 0
- OTX tags
- 2026-11,active,all-domains,blocklist,content,crypto,domains,drainer,fraud,live,monthly,phishdestroy,phishing,scam
- OTX checked
- 2026-11-11 14:11:20
- Scam type
- Crypto Drainer
- Detected brands
- metamask, phantom, trust wallet
- DOM risk score
- 100
- VirusTotal total scanners
- 92
- Cloak reason
- alive_content: raw=ok; http=200; via=https_proxy; server=Vercel
- Cloak checked at
- 2026-11-12 01:29:49
- Abuse score
- 0
- Abuse reports
- 290
- Abuse categories
- 4,7,8,9,10,11,14,15,17,18,19,20,21
- Abuse last at
- 2026-11-11 05:30:55
- Abuse checked at
- 2026-11-11 14:00:06
- Spamhaus checked at
- 2026-11-11 16:43:23
- Wallet addresses
{ "eth": [ "0x063f7cc5339f92a5fd7baf3d22233044fda1f327", "0x0f79931689af199e7cf868ed1107bb…
{ "eth": [ "0x063f7cc5339f92a5fd7baf3d22233044fda1f327", "0x0f79931689af199e7cf868ed1107bba2c83c68f7", "0x5c5a1106a4e2a9ca5fadab22d6a7dbed89a11bda", "0x63bfc3eb19629a9a968bfed6dd76c2d0adf09696", "0x74954541bbfeb66c7b0650da1b43a0e3d387168c", "0x8df4f39d592de2aaee15838b265c2392d19a4128", "0x98587c314b67742643561d077b14d2023c7676be", "0xa3c1d6a8648df3978a38ce1478fbc284c75d95d7", "0xb47c4c8f73f009cc0c0d3f92b388d13e293f0b65", "0xbce6ce62ef0bad529e5674a64fb23ce79df70e67", "0xf0394d1e25be152c9746791f5da3b287743f0e52" ] }- Wallet extracted at
- 2026-11-12 06:00:17
- URLScan score
- 100
- URLScan malicious
- Yes
- URLScan brands
- genericcrypto
- URLScan categories
- phishing
- URLScan result at
- 2026-11-12 05:30:21
- Cloak server header
- Vercel
- Cloak page title
- Kalos Fun — NFT Marketplace, DEX Swap & Token Launchpad on Elysium
- VirusTotal result state
- observed
- VirusTotal fetched at
- 2026-11-11 13:10:06
- VirusTotal observed at
- 2026-11-11 12:32:23
- URLScan captured at
- 2026-11-11 12:37:21
- URLScan result ID
- 01a1ca9c-aa60-7529-a2e3-9567d845d94a
- URLScan payload hash
- cdd0c0d2c46f13b550314b12bae94700497be3beee8b96fb56bbf9e3c9bae0f2
- URLScan evidence
{ "v": 1, "ip": "216.198.79.1", "asn": "AS16509", "ips": [ "216.24.57.18", "216.24.57.16",…
{ "v": 1, "ip": "216.198.79.1", "asn": "AS16509", "ips": [ "216.24.57.18", "216.24.57.16", "2a06:98c1:3120::3", "216.198.79.1" ], "tls": { "san": [ "*.kalosfun.com", "kalosfun.com" ], "cipher": "AES_128_GCM", "issuer": "YR2", "subject": "*.kalosfun.com", "protocol": "TLS 1.3", "valid_to": "2027-02-07T16:01:16Z", "valid_from": "2026-11-09T16:01:17Z" }, "asns": [ "397273", "13335", "16509" ], "uuid": "01a1ca9c-aa60-7529-a2e3-9567d845d94a", "score": 100, "title": "Kalos Fun — NFT Marketplace, DEX Swap & Token Launchpad on Elysium", "brands": [ "genericcrypto" ], "server": "Vercel", "social": [ "https://x.com/kalosfun" ], "status": 200, "country": "US", "domains": [ "kalos-test-trade.onrender.com", "media.kalos.fun", "api.kalos.fun" ], "globals": [ "__kalosSniperOpen", "kalosSyncSeoMeta", "kalosLoadingKind", "kalosSyncLoadingRoute", "q", "h", "p", "n", "KalosHeaderCache", "kalosLoadingMark", "Motion", "isAmount", "marketAmount", "exactAmount", "formatCount", "plural", "timeAgo", "rowTime", "formatPct", "KalosToasts", "Kit", "addRouteView", "legacyRoute", "routeSwapOff", "kalosSocialOn", "routeFromPath", "routeHref", "personProfile", "personName", "personTitle", "personRoute", "personTeamBadge", "installPersonTeamTooltip", "personPhotoUrl", "personGradientSeed", "personOklchRgb", "personColorFlaws", "personGradientColors", "personGradientStyle", "personGradient" ], "headers": { "server": "Vercel", "x-vercel-id": "cdg1::pzrnb-1794400629692-ce36a3ad1493", "content-type": "text/html; charset=utf-8", "x-vercel-cache": "HIT", "content-disposition": "inline", "strict-transport-security": "max-age=63072000", "access-control-allow-origin": "*", "access-control-allow-headers": "*", "access-control-allow-methods": "GET, POST, OPTIONS, PUT, DELETE" }, "asn_name": "AMAZON-02 - Amazon.com, Inc., US", "doc_hash": "7ffce15071d30b3aa87e397871cf88a882d99c1d9557026ed490788474dbb965", "requests": 205, "task_url": "https://kalosfun.com/", "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-2aab354" ], "score": 99, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "genericcrypto" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Generic Crypto" ], "malicious": true, "categories": [ "phishing" ] } }, "countries": [ "US" ], "final_url": "https://kalosfun.com/", "malicious": true, "categories": [ "phishing" ], "fetched_at": "2026-11-11T12:39:25Z", "scanned_at": "2026-11-11T12:37:21Z", "tls_issuer": "YR2", "captured_at": "2026-11-11 12:37:21.085000", "task_domain": "kalosfun.com", "link_domains": [ "elysium.kinetiq.xyz", "x.com" ], "payload_hash": "cdd0c0d2c46f13b550314b12bae94700497be3beee8b96fb56bbf9e3c9bae0f2", "storage_keys": [ "kalos-swap-arrange-v1", "kalos-arrange-hint", "kalos-api-health-v1:https://kalosfun.com/kapi", "kalos-api-trust-v1:https://kalosfun.com/kapi", "kalos-token-logos-v1:99901:https://kalosfun.com/kapi", "kalos-mini-history-v1:1no5wtl|native|hype|1D", "kalos-mini-history-v1:index", "kalos-mini-history-v1:1no5wtl|0xb47c4c8f73f009cc0c0d3f92b388d13e293f0b65|0xbce6c", "kalos-last-v1:99901:https://kalosfun.com/kapi" ], "technologies": [ "math.js" ], "tls_age_days": 1, "apex_age_days": 1, "script_hashes": [ "498d5358bc0dc7ad431a5e559e0de9250226c39254f5fae0a38e975ff81b76e7", "df61dba705a1a33d78e2cc8fc5c17f5e578fe53fac20e341c8f58da00991a233", "c44509f63206264f1b8cffa08a2fde50a5e65eb74ba45ac26e70901d418e1e08", "43605634dc67fea4652801b22a552d6ea4ad427800800100e268812cfb116bd9", "370e8b5da891364242e41ed61e6f5910fa69b143ad5d2580d9816cdaa0691afc", "f4ba1ef4831c046171151f2c007e6213baf69db5b7fc1cd18702962a4b10042b", "c5603cc7208fd0bdc273d2fc0237b7d9c2d05891ea60b1a808a3cc890d630627", "38d3ddbdda9168d1712f3909af9da68b87930111d120b9576f72ec5fb02ca702", "2aa0412b26021ef4a4146ad8d3211e61a88259f7d66d9462db064b683ce7ec5f", "ae096aaaa24705169564592cb54e6e4495cdf4712696f9d7f1dbf637be7814da" ], "tls_valid_days": 89, "domain_age_days": 1 }- Last reported at
- 2026-11-11 12:40:39
- Last report receipt ID
- 84692
Network, hosting & TLS
- IP address
- 216.198.79.1
- Nameservers
- ns1.dynu.com ns2.dynu.com ns3.dynu.com ns4.dynu.com ns5.dynu.com ns6.dynu.com
- DNS resolves
- Yes
- HTTP status
- 200
- IP country
- US
- IP city
- Atlanta
- IP org
- Network Billing Systems
- TLS issuer
- YR2
- TLS SANs
- *.kalosfun.com, kalosfun.com
- TLS valid from
- 2026-11-09 16:01:17
- TLS valid to
- 2027-02-07 16:01:16
- ASN
- 16509
- ASN name
- Network Billing Systems
- Server header
- Vercel
- CDN
- No
- Subdomains
- www.kalosfun.com
- DNS state
- resolved
Registration
- Registrar
- NameSilo, LLC
- Registrar country
- US
- WHOIS emails
- abuse@namesilo.com, abuse@vercel.com
- Creation date
- 2026-11-09 16:24:11
- Expiration date
- 2027-11-09 16:24:11
- Registrar action verified
- No
- Registrar action linked to report
- No
- Registration state
- unknown
Status, takedown & timeline
- Detected at
- 2026-11-11 13:38:41
- Reported at
- 2026-11-11 12:40:39
- Status
- enriched
- Site status
- alive
- Last alive
- 2026-11-12 01:29:49
- Last checked
- 2026-11-12 01:29:49
- Created at
- 2026-11-11 13:38:41
- Updated at
- 2026-11-12 06:00:17
- Outcome state
- unknown
- Outcome cause
- http_2xx_unclassified
- Outcome actor type
- unknown
- Outcome confidence
- 40
- Outcome evidence source
- current_state_backfill
- Outcome evidence at
- 2026-11-11 13:38:41.000000
- Outcome evidence
{ "reason": "", "http_status": 200, "observed_at": "2026-11-11 13:38:41", "latest_http_obs…
{ "reason": "", "http_status": 200, "observed_at": "2026-11-11 13:38:41", "latest_http_observation": { "cause": "http_2xx_unclassified", "state": "unknown", "source": "http_observation", "mechanism": null, "actor_name": null, "actor_type": "unknown", "confidence": 40, "observed_at_utc": "2026-11-11 12:38:41", "availability_state": "unknown", "provider_action_verified": false } }- Outcome evidence at (UTC)
- 2026-11-11 12:38:41.000000
- Availability state
- unknown
- Content state
- unknown
- Last reachable at (UTC)
- 2026-11-11 12:38:41.000000
- Shutdown time basis
- inconclusive
- Shutdown time precision
- open
Page & captures
- Source URL
- https://kalosfun.com/
- Screenshot URL
- https://i.ibb.co/Kx2X9Q6Q/ddaeb4284ad2.png
- Page title
- Kalos Fun — NFT Marketplace, DEX Swap & Token Launchpad on Elysium
- Favicon hash
- 2ae067bb22898a9532757959e5ace596
- Technologies
{ "cf": { "v": 1, "ip": "127.0.1.30", "dns": [ { "name": "kalosfun.com", "type": "A", "val…
{ "cf": { "v": 1, "ip": "127.0.1.30", "dns": [ { "name": "kalosfun.com", "type": "A", "value": "216.198.79.1" } ], "uuid": "4a017b80-97e6-4147-a4ce-5397a4b18c0c", "whois": { "created": "2026-11-09T16:24:11Z", "expires": "2027-11-09T16:24:11Z", "updated": "2026-11-11T11:25:07Z", "registrar": "NameSilo, LLC", "nameservers": [ "ns1.dynu.com", "ns2.dynu.com", "ns3.dynu.com", "ns4.dynu.com" ] }, "status": 200, "history": [ { "url": "https://kalosfun.com/", "status": 200 } ], "doc_hash": "7ffce15071d30b3aa87e397871cf88a882d99c1d9557026ed490788474dbb965", "dom_hash": "84ec98991a6bb47c5ed68698996feb3b4557d6e8b9872f6d8a87592912eae7ec", "task_url": "https://kalosfun.com/", "final_url": "https://kalosfun.com/", "fetched_at": "2026-11-11T13:12:35Z", "radar_rank": { "bucket": ">200000" }, "scanned_at": "2026-11-11T13:11:18Z", "task_domain": "kalosfun.com", "dnssec_valid": false, "domain_risks": [ "Newly Seen Domains", "Security Risks", "New Domains" ] }, "vt": { "v": 1, "dns": [ { "ttl": 3600, "type": "NS", "value": "ns6.dynu.com" }, { "ttl": 3600, "type": "NS", "value": "ns2.dynu.com" }, { "ttl": 3600, "type": "NS", "value": "ns3.dynu.com" }, { "ttl": 3600, "type": "NS", "value": "ns4.dynu.com" }, { "ttl": 120, "type": "A", "value": "216.198.79.1" }, { "ttl": 3600, "type": "NS", "value": "ns5.dynu.com" }, { "ttl": 3600, "type": "NS", "value": "ns1.dynu.com" }, { "ttl": 3600, "type": "SOA", "rname": "administrator.dynu.com", "value": "ns1.dynu.com" } ], "cert": { "san": [ "*.kalosfun.com", "kalosfun.com" ], "issuer": "Let's Encrypt / YR2", "serial": "6b09efdff89242c0d969368614a03a519e8", "sha256": "ce68ce287e4df262078f7122c33a37682f4bfbe9e93da1f8e21e7ac8a751dc2f", "subject": "*.kalosfun.com", "valid_to": "2027-02-07T16:01:16Z", "valid_from": "2026-11-09T16:01:17Z", "observed_at": "2026-11-11T12:32:35Z" }, "jarm": "3fd3fd00000000000043d43d00043dc3b2afa8a5ec09b510a8559aff7899fb", "rdap": { "events": { "last changed": "2026-11-10T00:12:46Z", "registration": "2026-11-09T00:00:00Z", "registrar expiration": "2027-11-09T00:00:00Z", "last update of RDAP database": "2026-11-11T12:32:35Z" }, "status": [ "client transfer prohibited" ] }, "stats": { "timeout": 0, "harmless": 0, "malicious": 0, "suspicious": 0, "undetected": 92 }, "whois": { "dnssec": "unsigned", "status": [ "clientTransferProhibited" ], "created": "2026-11-09T16:24:11Z", "expires": "2027-11-09T16:24:11Z", "updated": "2026-11-11T11:25:07Z", "registrar": "NameSilo, LLC", "abuse_email": "abuse@namesilo.com", "abuse_phone": "+1.4805240066", "nameservers": [ "ns1.dynu.com", "ns2.dynu.com", "ns3.dynu.com", "ns4.dynu.com" ], "registrar_url": "http://www.namesilo.com", "registrar_iana_id": "1479" }, "dns_at": "2026-11-11T12:32:35Z", "created": "2026-11-09T16:24:11Z", "expires": "2027-11-09T16:24:11Z", "updated": "2026-11-11T11:25:07Z", "registrar": "NameSilo, LLC", "fetched_at": "2026-11-11T13:10:05Z", "first_seen": "2026-11-11T12:32:35Z", "reputation": 0, "analysis_at": "2026-11-11T12:32:23Z" }, "shots": { "v": 1, "cf": { "url": "https://screenshots.phishdestroy.io/cf/4a017b80-97e6-4147-a4ce-5397a4b18c0c.png", "scan": "4a017b80-97e6-4147-a4ce-5397a4b18c0c", "bytes": 122927, "sha256": "2cdc3b2dcad1f5e6be96f49f0700045152a0b34f5b53ccad36dd439c96f0f629" }, "urlscan": { "url": "https://screenshots.phishdestroy.io/us/01a1ca9c-aa60-7529-a2e3-9567d845d94a.png", "uuid": "01a1ca9c-aa60-7529-a2e3-9567d845d94a", "bytes": 43044, "sha256": "6b407634fe41403d99f107a79bb202a87b0273d4ca55c1a6f669885347efec4f" }, "urlquery": { "url": "https://screenshots.phishdestroy.io/uq/d8fd5848-02d5-40a6-99fb-2dbe1bd02f2a.png", "bytes": 102182, "report": "d8fd5848-02d5-40a6-99fb-2dbe1bd02f2a", "sha256": "c0ce746f1cba9450f0713cc1627bc2d4638158830d38b0c00604b94788ab7d70" }, "fetched_at": "2026-11-11T13:13:28Z", "urlscan_history": { "total": 1 } }, "urlscan": { "v": 1, "ip": "216.198.79.1", "ips": [ "216.24.57.18", "216.24.57.16", "2a06:98c1:3120::3", "216.198.79.1" ], "tls": { "san": [ "*.kalosfun.com", "kalosfun.com" ], "cipher": "AES_128_GCM", "issuer": "YR2", "subject": "*.kalosfun.com", "protocol": "TLS 1.3", "valid_to": "2027-02-07T16:01:16Z", "valid_from": "2026-11-09T16:01:17Z" }, "asns": [ "397273", "13335", "16509" ], "uuid": "01a1ca9c-aa60-7529-a2e3-9567d845d94a", "social": [ "https://x.com/kalosfun" ], "status": 200, "domains": [ "kalos-test-trade.onrender.com", "media.kalos.fun", "api.kalos.fun" ], "globals": [ "__kalosSniperOpen", "kalosSyncSeoMeta", "kalosLoadingKind", "kalosSyncLoadingRoute", "q", "h", "p", "n", "KalosHeaderCache", "kalosLoadingMark", "Motion", "isAmount", "marketAmount", "exactAmount", "formatCount", "plural", "timeAgo", "rowTime", "formatPct", "KalosToasts", "Kit", "addRouteView", "legacyRoute", "routeSwapOff", "kalosSocialOn", "routeFromPath", "routeHref", "personProfile", "personName", "personTitle", "personRoute", "personTeamBadge", "installPersonTeamTooltip", "personPhotoUrl", "personGradientSeed", "personOklchRgb", "personColorFlaws", "personGradientColors", "personGradientStyle", "personGradient" ], "headers": { "server": "Vercel", "x-vercel-id": "cdg1::pzrnb-1794400629692-ce36a3ad1493", "content-type": "text/html; charset=utf-8", "x-vercel-cache": "HIT", "content-disposition": "inline", "strict-transport-security": "max-age=63072000", "access-control-allow-origin": "*", "access-control-allow-headers": "*", "access-control-allow-methods": "GET, POST, OPTIONS, PUT, DELETE" }, "doc_hash": "7ffce15071d30b3aa87e397871cf88a882d99c1d9557026ed490788474dbb965", "requests": 205, "task_url": "https://kalosfun.com/", "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-2aab354" ], "score": 99, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "genericcrypto" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Generic Crypto" ], "malicious": true, "categories": [ "phishing" ] } }, "countries": [ "US" ], "final_url": "https://kalosfun.com/", "fetched_at": "2026-11-11T12:39:25Z", "scanned_at": "2026-11-11T12:37:21Z", "task_domain": "kalosfun.com", "link_domains": [ "elysium.kinetiq.xyz", "x.com" ], "storage_keys": [ "kalos-swap-arrange-v1", "kalos-arrange-hint", "kalos-api-health-v1:https://kalosfun.com/kapi", "kalos-api-trust-v1:https://kalosfun.com/kapi", "kalos-token-logos-v1:99901:https://kalosfun.com/kapi", "kalos-mini-history-v1:1no5wtl|native|hype|1D", "kalos-mini-history-v1:index", "kalos-mini-history-v1:1no5wtl|0xb47c4c8f73f009cc0c0d3f92b388d13e293f0b65|0xbce6c", "kalos-last-v1:99901:https://kalosfun.com/kapi" ], "tls_age_days": 1, "apex_age_days": 1, "script_hashes": [ "498d5358bc0dc7ad431a5e559e0de9250226c39254f5fae0a38e975ff81b76e7", "df61dba705a1a33d78e2cc8fc5c17f5e578fe53fac20e341c8f58da00991a233", "c44509f63206264f1b8cffa08a2fde50a5e65eb74ba45ac26e70901d418e1e08", "43605634dc67fea4652801b22a552d6ea4ad427800800100e268812cfb116bd9", "370e8b5da891364242e41ed61e6f5910fa69b143ad5d2580d9816cdaa0691afc", "f4ba1ef4831c046171151f2c007e6213baf69db5b7fc1cd18702962a4b10042b", "c5603cc7208fd0bdc273d2fc0237b7d9c2d05891ea60b1a808a3cc890d630627", "38d3ddbdda9168d1712f3909af9da68b87930111d120b9576f72ec5fb02ca702", "2aa0412b26021ef4a4146ad8d3211e61a88259f7d66d9462db064b683ce7ec5f", "ae096aaaa24705169564592cb54e6e4495cdf4712696f9d7f1dbf637be7814da" ], "tls_valid_days": 89, "domain_age_days": 1 }, "cf_radar": { "verdict": "suspicious", "categories": [ "New Domains", "Security Risks" ], "is_malicious": false }, "webcheck": { "v": 1, "dns": { "A": [ "216.198.79.1" ], "NS": [ "ns3.dynu.com", "ns2.dynu.com", "ns1.dynu.com", "ns6.dynu.com", "ns5.dynu.com", "ns4.dynu.com" ], "SOA": "{\"nsname\": \"ns1.dynu.com\", \"hostmaster\": \"administrator.dynu.com\", \"serial\": 5, \"refresh\": 3600, \"retry\": 900, \"expire\": 604800, \"minttl\": 300}" }, "ssl": { "issuer": "Let's Encrypt / YR2", "subject": "*.kalosfun.com" }, "hsts": { "header": "max-age=63072000", "message": "HSTS header does not include all subdomains." }, "whois": { "status": [ "clientTransferProhibited https://icann.org/epp#clientTransferProhibited" ], "created": "2026-11-09T16:24:11Z", "expires": "2027-11-09T16:24:11Z", "updated": "2026-11-11T11:25:07Z", "registrar": "NameSilo, LLC", "nameservers": [ "ns1.dynu.com", "ns2.dynu.com", "ns3.dynu.com", "ns4.dynu.com" ] }, "carbon": { "bytes": 179284, "co2_grams": 0.0066, "cleaner_than": 9 }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "get_ip": { "ip": "216.198.79.1", "family": 4 }, "status": { "up": true, "code": 200, "timings": { "dns": 272, "tls": 13, "wait": 26, "connect": 8, "download": 11 }, "response_ms": 330 }, "headers": { "headers": { "server": "Vercel", "x-vercel-id": "fra1::nn8l9-1794401906130-fae51f84537d", "content-type": "text/html; charset=utf-8", "x-vercel-cache": "HIT", "content-disposition": "inline", "strict-transport-security": "max-age=63072000", "access-control-allow-origin": "*", "access-control-allow-headers": "*", "access-control-allow-methods": "GET, POST, OPTIONS, PUT, DELETE" } }, "sitemap": { "present": true, "url_count": 18 }, "archives": { "last": "2026-11-11T12:47:44Z", "first": "2026-11-11T12:47:44Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 32243 }, "location": { "ip": "216.198.79.1", "asn": "16509", "org": "Network Billing Systems", "city": "Atlanta", "country": "US" }, "trackers": { "requests": 119 }, "redirects": { "chain": [ "https://kalosfun.com" ] }, "dns_server": { "ns": [ { "ip": "162.251.164.146", "host": "ns3.dynu.com" }, { "ip": "108.181.13.234", "host": "ns2.dynu.com" }, { "ip": "108.181.159.122", "host": "ns4.dynu.com" }, { "ip": "216.105.169.98", "host": "ns5.dynu.com" }, { "ip": "72.51.58.2", "host": "ns1.dynu.com" }, { "ip": "173.0.55.138", "host": "ns6.dynu.com" } ], "zone": "kalosfun.com" }, "fetched_at": "2026-11-11T12:59:04Z", "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://kalosfun.com/sitemap.xml" ] }, "tech_stack": { "technologies": [ "Vercel", "Priority Hints", "HSTS", "PWA", "Open Graph" ] }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "mail_config": { "spf_lookups": 0 }, "social_tags": { "ogUrl": "https://kalosfun.com/", "title": "Kalos Fun — NFT Marketplace, DEX Swap & Token Launchpad on Elysium", "author": "Kalos Fun", "ogType": "website", "robots": "index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1", "ogImage": "https://kalosfun.com/assets/og/kalos-card.jpg", "ogTitle": "Kalos Fun — NFT Marketplace, DEX Swap & Token Launchpad on Elysium", "keywords": "Kalos Fun, Kalos, kalosfun, kalosfun.com, Kalos Fun Marketplace, Kalos NFT Marketplace, Kalos DEX, Kalos Swap, Kalos Drops, Kalos Launchpad, Kalos Fate, Kalos Rewards, Kalos Sniper, Elysium NFT, Kinetiq Elysium, Hyperliquid NFT, Web3 Marketplace", "ogSiteName": "Kalos Fun", "themeColor": "#171717", "description": "Kalos Fun (kalosfun.com) is the premier NFT Marketplace, DEX Swap, Token Launchpad, and Fate ecosystem on Kinetiq Elysium. Discover collections, trade NFTs, swap tokens, and earn rewards on Kalos Fun.", "twitterCard": "summary_large_image", "twitterSite": "@kalosfun", "canonicalUrl": "https://kalosfun.com/", "ogDescription": "Kalos Fun is the all-in-one NFT marketplace, decentralized exchange (DEX), token sniper, and launchpad on Kinetiq Elysium. Discover collections, trade NFTs, swap tokens, and earn rewards.", "twitterCreator": "@kalosfun" }, "linked_pages": { "external": [ "https://elysium.kinetiq.xyz/testnet-faucet", "https://x.com/kalosfun", "https://elysium.kinetiq.xyz/testnet-explorer" ], "external_count": 3, "internal_count": 11 }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": "max-age=63072000", "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "mixed_content": { "third_party_scripts": 0 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_128_GCM_SHA256", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "social_presence": { "profiles": [ "https://x.com/kalosfun" ] } }, "cf_radar_technologies": [ { "app": "Vercel", "icon": "vercel.svg", "name": "Vercel", "website": "https://vercel.com", "categories": [ { "name": "PaaS", "priority": 8 } ], "description": "Vercel is a cloud platform for static frontends and serverless functions.", "confidenceTotal": 100 }, { "app": "Render", "icon": "Render.svg", "name": "Render", "website": "https://render.com", "categories": [ { "name": "PaaS", "priority": 8 } ], "description": "Render is a cloud computing platform that provides a wide range of services, including web hosting, cloud computing, and application development. Render offers several hosting options, including static site hosting, web application hosting, and managed databases.", "confidenceTotal": 100 }, { "app": "math.js", "icon": "math.js.png", "name": "math.js", "website": "https://mathjs.org", "categories": [ { "name": "JavaScript libraries", "priority": 9 } ], "description": "Math.js a JavaScript library that provides a comprehensive set of mathematical functions and capabilities for performing complex calculations and operations in web applications.", "confidenceTotal": 100 }, { "app": "HSTS", "icon": "default.svg", "name": "HSTS", "website": "https://www.rfc-editor.org/rfc/rfc6797#section-6.1", "categories": [ { "name": "Security", "priority": 9 } ], "description": "HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.", "confidenceTotal": 100 }, { "app": "Cloudflare", "icon": "CloudFlare.svg", "name": "Cloudflare", "website": "https://www.cloudflare.com", "categories": [ { "name": "CDN", "priority": 9 } ], "description": "Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.", "confidenceTotal": 100 } ] }- Wayback saved at
- 2026-11-11 13:54:20
Other
- AI generated at
- 2026-11-11 14:13:05
- AI queued
- 2
- Indexnow sent at
- 2026-11-11 14:00:05
- AI generated by
- threat-v6-mimo
- DOM analyzed at
- 2026-11-11 14:15:06
Captured network requests
Network requests: 205 SHA-256 hashes: 202 URLScan scan:
Network requests that the URLScan browser recorded while loading the page. URLScan does not provide a hash for every request. PhishDestroy retrieved this list on 2026-11-11 12:39 UTC.
Open this scan on URLScan 01a1ca9c-aa60-7529-a2e3-9567d845d94a ↗
| # | Network request | HTTP method · status | Type | Uncompressed size | Response body SHA-256 |
|---|
Stored observation history1
Dated changes retained by the monitor and source collectors. Newest observations appear first; source states are not proof of a takedown.
- Domain monitor · First collection record
Reachable
All retained availability observations3
Source: availability monitor. Every retained observation remains separate, including records with the same date or evidence hash but different sources or DNS states. An unknown state is not proof that the site is offline.
-
dns_observationunknown
- Observation source
- dns_observation
- Cause
- probe_inconclusive
- Availability state
- unreachable
- Content state
- unknown
- DNS state
- resolved
- DNS response code
- NOERROR
- Registration state
- unknown
- RDAP statuses
- []
- Recorded actor type
- unknown
- Monitor confidence
- 20
- Provider action verified
- false
- Registrar mechanism verified
- false
- Linked to a report
- false
- Original source timestamp
- 2026-11-11 23:22:06.823408
- Evidence SHA-256
- c2d0fde1b8ec38cdebac32986da9714f597187c4b8f8a37805f96f479fde5d53
- HTTP probe value as recorded
- 0 · no HTTP response code recorded
- Evidence timestamp as recorded
- 2026-11-11 23:22:06.823408
- Evidence reason
-
current_state_backfillunknown
- Observation source
- current_state_backfill
- Cause
- http_2xx_unclassified
- Availability state
- unknown
- Content state
- unknown
- DNS state
- resolved
- DNS response code
- NOERROR
- Recorded HTTP status
- 200
- Registration state
- unknown
- RDAP statuses
- []
- Recorded actor type
- unknown
- Monitor confidence
- 40
- Provider action verified
- false
- Registrar mechanism verified
- false
- Linked to a report
- false
- Original source timestamp
- 2026-11-11 13:38:41.000000
- Evidence SHA-256
- 4a66e99fa5edf60935bf51ae9510ba18319e8325bd89c6b0c76d723a48bc3de0
- HTTP probe value as recorded
- 200
- Evidence timestamp as recorded
- 2026-11-11 13:38:41
- Evidence reason
-
http_observationunknown
- Observation source
- http_observation
- Cause
- http_2xx_unclassified
- Availability state
- unknown
- Content state
- unknown
- DNS state
- unknown
- Recorded HTTP status
- 200
- Registration state
- unknown
- RDAP statuses
- []
- Recorded actor type
- unknown
- Monitor confidence
- 40
- Provider action verified
- false
- Registrar mechanism verified
- false
- Linked to a report
- false
- Original source timestamp
- 2026-11-11 13:38:41.000000
- Evidence SHA-256
- 4a66e99fa5edf60935bf51ae9510ba18319e8325bd89c6b0c76d723a48bc3de0
- HTTP probe value as recorded
- 200
- Evidence timestamp as recorded
- 2026-11-11 13:38:41
- Evidence reason
Threat Response Pipeline
- Discovery · recorded
- Analysis · recorded
- Notifications · recorded
- Monitoring · in progress
Recorded events: 11. These records describe collected evidence, outgoing notifications and publication; they do not confirm a complete investigation or a takedown.
Pre-emptive Discovery & IngestionThreat Ingested Recorded: 1 of 1
- Threat Ingestedkalosfun.com detected and queued for full analysis
Threat Intelligence ChecksURLScan.io Capture · URLScan Verdict · Cloudflare Radar Report · Web Archive · OTX Community References · Registrar Context: NameSilo · Forensic Evidence Collected · Technical Analysis Recorded Recorded: 8 of 8
- URLScan.io CaptureStored URLScan report with capture artifacts
- URLScan VerdictURLScan classified the page as malicious · Score: 100
- Cloudflare Radar ReportA stored Cloudflare Radar report is available. The report link alone does not mean that the domain was classified as malicious, and it does not prove that every network field was captured.
- Web ArchivePreserved in the Wayback Machine: historical evidence archived
- OTX Community ReferencesCommunity publication references on AlienVault OTX: 4. References are not vendor verdicts and are excluded from the evidence score.
- Registrar Context: NameSiloSeparate registrar research is available. Registrar association is contextual and is not scored as an independent detection.
- Forensic Evidence CollectedStored evidence from URLScan.io, URLQuery, stored screenshot
- Technical Analysis RecordedThe report contains stored results of technology detection or forensic analysis.
Notification RecordsSent Report Recorded Recorded: 1 of 1
- Sent Report RecordedStored record of an abuse report about this domain; registrar at the time: NameSilo, LLC. Abuse contacts: 1.
- abuse@namesilo.com
Publication & AvailabilityDestroyList Published · Monitoring Continues Recorded: 1 of 2
- DestroyList PublishedListed in the public repository PhishDestroy/DestroyList
- Monitoring ContinuesThe domain remains reachable or access-restricted; future checks may update this observation.
Recorded activity
6 entries- AlienVault OTX
4 community references
View source - Wayback Machine
Page archived
View source - Abuse report sent
PD-C9533574308C30B0C875 · Receipt 84692
abuse@namesilo.com - Added to PhishDestroy
kalosfun.com
View source - URLScan
Page captured
View source - VirusTotal
0/92 engine detections
View source
How we investigate & report
Public scans, evidence and abuse channels
We scan suspicious URLs, inspect public results and send evidence through the appropriate abuse-reporting channels. The dated events above show what is recorded for this domain. The directory below explains the wider workflow.
01Public scans & evidence collection10 sources and tool groups
urlscan.io Screenshot · DOM · HTTP
Capture the rendered page, requests and visible infrastructure.
VirusTotal Multi-engine verdicts
Compare the available engine results and retain the analysis timestamp.
Google Safe Browsing Transparency Report
Check whether Google currently lists the URL as unsafe.
Cloudflare Radar DNS · certificates · categories
Inspect a public scan and its recorded network and classification data.
AlienVault OTX Threat-intelligence pulses
Look for indicator references and related community intelligence.
Wayback Machine Historical evidence
Compare archived captures and preserve historical context.
abuse.ch ThreatFox IOC correlation
Look for matching indicators and associated threat records.
crt.sh Certificate Transparency
Inspect certificate records and related hostnames.
DNS Security Filters Quad9 · AdGuard · CleanBrowsing
Compare security resolver responses and record observed blocking.
Web-Check Surface inspection
Inspect the public DNS, TLS, HTTP and technology surface.
02Abuse reports & follow-upRegistrar, hosting and security channels
- Identify the responsible provider. Match registration and hosting records to the relevant abuse contact.
- Prepare an evidence package. Include the URL, public scan references, captures and the recorded observations.
- Send the report. Keep outgoing report records and recipient information when available.
- Recheck and publish updates. Track later scanner verdicts, provider responses and site availability.
Security services used for scanning, reputation checks and reporting are listed below. A service being listed is not evidence that it received, accepted or acted on this particular domain. Recorded submissions appear in the notification history above.
GoogleSafe Browsing↗ GoogleWeb Risk↗ 
MicrosoftSmartScreen↗ 
VirusTotalURL analysis↗ 
CloudflareRadar / abuse reporting↗ 
YandexSafe Browsing↗ 
URLScan.ioPublic scan↗ 
ESETSample / URL submission↗ 
BitdefenderURL submission↗ 
NortonSafe Web↗ 
SymantecSiteReview↗ 
AviraURL reporting↗ 
Avast / AVGURL reporting↗ 
KasperskyOpenTIP↗ 
Dr.WebOnline scanner↗ 
NetcraftAbuse reporting↗ 
PhishTankCommunity reporting↗ 
APWG eCXPhishing intelligence↗ 
PhishStatsPublic feed↗ 
Phish.ReportHosting abuse↗ 
SpamhausDomain reputation↗ 
PolySwarmMulti-engine analysis↗ 
CheckPhishURL scan↗ 
QutteraMalware scan↗ 
URLqueryBrowser analysis↗ 
Criminal IPAsset intelligence↗ 
CRDFThreat Center↗ 
ScamadviserReputation check↗ 
MyWOTCommunity reputation↗ All stored records by source
Browse this domain’s complete history by source. The download includes every record of the selected source. Dates retain their original field labels.
Download all records as JSON| ID | Stored data |
|---|
Lookalike domains
186 stored lookalike domains
Names that imitate the brand, found by dnstwist. A similar name alone does not prove the same owner.
trustwallst.com Replaced character Variant of trustwallet.com Internal report A 45.205.7.2NS a.share-dns.com trustwallzt.com Replaced character Variant of trustwallet.com Internal report A 45.205.7.14NS a.share-dns.com trustgallet.com Bit flip Variant of trustwallet.com Internal report A 45.205.7.23NS a.share-dns.com trustwallet3.com Added character Variant of trustwallet.com Internal report A 156.238.250.210NS a.share-dns.com trustwallet7.com Added character Variant of trustwallet.com Internal report A 156.238.250.210NS a.share-dns.com trustwalletn.com Added character Variant of trustwallet.com Internal report A !ServFailNS !ServFail trustwalletz.com Added character Variant of trustwallet.com Internal report A 156.251.149.20NS ns4.myhostadmin.net trustwcllet.com Bit flip Variant of trustwallet.com Internal report A 45.205.7.29NS a.share-dns.com trustwsallet.com Inserted character Variant of trustwallet.com Internal report A 156.235.6.178NS ns1.myhostadmin.net trustwxallet.com Inserted character Variant of trustwallet.com Internal report A 156.235.6.169NS ns1.myhostadmin.net xn--trustwalle-b22e.com Lookalike letters Variant of trustwallet.com Internal report A 104.21.31.223NS andronicus.ns.cloudflare.com etamask.io Missing character Variant of metamask.io Internal report A 185.66.140.182MX etamask.ioNS ns13.knownsrv.com
Show all (88)
meetamask.io Repeated character Variant of metamask.io Internal report A 185.66.140.182MX meetamask.ioNS ns13.knownsrv.com megamask.io Replaced character Variant of metamask.io Internal report A 66.96.162.138MX alt1.aspmx.l.google.comNS ns1.domain.com metam.ask.io Split into subdomain Variant of metamask.io Internal report A 15.197.162.184 metamaak.io Replaced character Variant of metamask.io Internal report A 185.66.140.182MX metamaak.ioNS ns13.knownsrv.com metamadk.io Replaced character Variant of metamask.io Internal report A 185.66.140.182MX metamadk.ioNS ns13.knownsrv.com metamaks.io Swapped characters Variant of metamask.io Internal report A 185.66.140.182MX metamaks.ioNS ns13.knownsrv.com metamassk.io Inserted character Variant of metamask.io Internal report A 185.66.140.182MX metamassk.ioNS ns13.knownsrv.com metamsask.io Inserted character Variant of metamask.io Internal report A 185.66.140.182MX metamsask.ioNS ns13.knownsrv.com metamssk.io Replaced character Variant of metamask.io Internal report A 185.66.140.182MX metamssk.ioNS ns13.knownsrv.com metanask.io Lookalike letters Variant of metamask.io Internal report A 185.66.140.182MX metanask.ioNS ns13.knownsrv.com metanmask.io Lookalike letters Variant of metamask.io Internal report A 185.66.140.182MX metanmask.ioNS ns13.knownsrv.com metasmask.io Inserted character Variant of metamask.io Internal report A 185.66.140.182MX metasmask.ioNS ns13.knownsrv.com metramask.io Inserted character Variant of metamask.io Internal report A 185.66.140.182MX metramask.ioNS ns13.knownsrv.com mewtamask.io Inserted character Variant of metamask.io Internal report A 185.66.140.182MX mewtamask.ioNS ns13.knownsrv.com mmetamask.io Lookalike letters Variant of metamask.io Internal report A 185.66.140.182MX mmetamask.ioNS ns13.knownsrv.com mtamask.io Missing character Variant of metamask.io Internal report A 185.66.140.182MX mtamask.ioNS ns13.knownsrv.com mwetamask.io Inserted character Variant of metamask.io Internal report A 185.66.140.182MX mwetamask.ioNS ns13.knownsrv.com nmetamask.io Lookalike letters Variant of metamask.io Internal report A 185.66.140.182MX nmetamask.ioNS ns13.knownsrv.com metamark.io Bit flip Variant of metamask.io Internal report A 13.248.213.45MX mx0.123-reg.co.ukNS ns45.domaincontrol.com metamaskj.io Added character Variant of metamask.io Internal report A 185.66.140.182MX metamaskj.ioNS ns13.knownsrv.com metammask.io Lookalike letters Variant of metamask.io Internal report A 185.66.140.182MX metammask.ioNS ns13.knownsrv.com metamnask.io Lookalike letters Variant of metamask.io Internal report A 185.66.140.182MX metamnask.ioNS ns13.knownsrv.com grustwallet.com Replaced character Variant of trustwallet.com A 47.243.69.130NS a.share-dns.com t.rustwallet.com Split into subdomain Variant of trustwallet.com NS ns1.namebrightdns.com trastwallet.com Vowel swap Variant of trustwallet.com A 104.21.74.187NS major.ns.cloudflare.com trostwallet.com Vowel swap Variant of trustwallet.com NS 1-you.njalla.no trsutwallet.com Swapped characters Variant of trustwallet.com MX mx.zoho.comNS dave.ns.cloudflare.com trusfwallet.com Replaced character Variant of trustwallet.com A 91.204.209.6MX trusfwallet.comNS ns1.hostns.io trusrwallet.com Replaced character Variant of trustwallet.com A 139.162.174.209 trusstwallet.com Plural form Variant of trustwallet.com A 13.248.169.48NS ns1.dan.com trusttwallet.com Repeated character Variant of trustwallet.com A 208.98.40.203 trustw.allet.com Split into subdomain Variant of trustwallet.com A 139.162.174.209 trustwa.llet.com Split into subdomain Variant of trustwallet.com A 13.248.169.48NS ns1.namefind.com trustwaklet.com Replaced character Variant of trustwallet.com A 47.243.69.130NS a.share-dns.com trustwalelt.com Swapped characters Variant of trustwallet.com A 188.114.96.3NS nico.ns.cloudflare.com trustwalket.com Replaced character Variant of trustwallet.com A 47.243.69.130NS a.share-dns.com trustwall3t.com Replaced character Variant of trustwallet.com A 34.120.137.41MX mx1.hostinger.comNS ns1.dns-parking.com trustwalleet.com Repeated character Variant of trustwallet.com A 43.157.105.4MX mail.trustwalleet.comNS ns1.dyna-ns.net trustwallef.com Replaced character Variant of trustwallet.com A 104.21.35.38NS byron.ns.cloudflare.com trustwaller.com Replaced character Variant of trustwallet.com A 13.223.25.84NS nsg1.namebrightdns.com trustwallit.com Vowel swap Variant of trustwallet.com A 213.111.149.204MX trustwallit.comNS dns1.icedns.is trustwalllet.com Repeated character Variant of trustwallet.com A 13.248.169.48NS ns5.afternic.com trustwallot.com Vowel swap Variant of trustwallet.com A 213.111.149.204MX trustwallot.comNS dns1.icedns.is trustwallte.com Swapped characters Variant of trustwallet.com MX mx.zoho.comNS cesar.ns.cloudflare.com trustwlalet.com Swapped characters Variant of trustwallet.com A 188.114.96.3NS nico.ns.cloudflare.com trustwollet.com Vowel swap Variant of trustwallet.com A 43.198.87.21NS ns1.dyna-ns.net trustwullet.com Vowel swap Variant of trustwallet.com A 194.156.117.152NS brodie.ns.cloudflare.com trustwwllet.com Replaced character Variant of trustwallet.com A 3.167.227.113NS grannbo.ns.cloudflare.com trustwzllet.com Replaced character Variant of trustwallet.com A 47.243.69.130NS a.share-dns.com trutswallet.com Swapped characters Variant of trustwallet.com A 172.233.219.123MX mx156.hostedmxserver.comNS ns1.parklogic.com truustwallet.com Repeated character Variant of trustwallet.com A 188.114.96.3NS nico.ns.cloudflare.com trystwallet.com Replaced character Variant of trustwallet.com A 13.223.25.84NS nsg1.namebrightdns.com turstwallet.com Swapped characters Variant of trustwallet.com A 45.91.226.134NS ns1.julydns.com rustwallet.com Missing character Variant of trustwallet.com NS ns1.namebrightdns.com trestwallet.com Bit flip Variant of trustwallet.com A 147.161.37.75NS aldo.ns.cloudflare.com trrustwallet.com Inserted character Variant of trustwallet.com A 13.223.25.84NS nsg1.namebrightdns.com tructwallet.com Bit flip Variant of trustwallet.com A 66.78.41.20MX mail.tructwallet.comNS ns1.server1.webhostmost.com truestwallet.com Inserted character Variant of trustwallet.com A 13.223.25.84NS nsg1.namebrightdns.com truhstwallet.com Inserted character Variant of trustwallet.com A 179.43.144.214MX mail.h-email.netNS ns1.panamans.com truistwallet.com Inserted character Variant of trustwallet.com A 15.197.148.33NS ns05.domaincontrol.com trusdtwallet.com Inserted character Variant of trustwallet.com A 91.195.240.94NS ns1cnb.name.com trusdwallet.com Bit flip Variant of trustwallet.com A 91.195.240.94NS ns1cnb.name.com trust-wallet.com Added hyphen Variant of trustwallet.com A 44.232.173.249NS launch1.spaceship.net trust2wallet.com Inserted character Variant of trustwallet.com A 13.248.243.5NS ns45.domaincontrol.com trustewallet.com Inserted character Variant of trustwallet.com A 13.223.25.84NS nsg1.namebrightdns.com trustqwallet.com Inserted character Variant of trustwallet.com A 13.223.25.84NS nsg1.namebrightdns.com trustrwallet.com Inserted character Variant of trustwallet.com A 13.223.25.84NS nsg1.namebrightdns.com trustswallet.com Inserted character Variant of trustwallet.com A 86.105.245.69NS ns1.eftydns.com trustuallet.com Bit flip Variant of trustwallet.com A 188.114.96.3NS ariella.ns.cloudflare.com trustvallet.com Bit flip Variant of trustwallet.com A 13.248.169.48NS ns1.afternic.com trustwa11et.com Lookalike letters Variant of trustwallet.com A 216.120.147.200NS ns100.webnic.cc trustwa1let.com Lookalike letters Variant of trustwallet.com A 196.251.84.147MX mx.zoho.euNS ns2.1domainregistry.com trustwaallet.com Inserted character Variant of trustwallet.com A 156.235.6.179NS ns1.myhostadmin.net trustwaiiet.com Lookalike letters Variant of trustwallet.com A 13.223.25.84NS nsg1.namebrightdns.com trustwailet.com Lookalike letters Variant of trustwallet.com A 91.195.240.94NS ns1cnb.name.com trustwal1et.com Lookalike letters Variant of trustwallet.com A 156.251.149.9NS ns4.myhostadmin.net trustwalet.com Missing character Variant of trustwallet.com A 78.41.207.39NS ns1.torresdns.com trustwaliet.com Lookalike letters Variant of trustwallet.com A 13.223.25.84NS nsg1.namebrightdns.com trustwallat.com Bit flip Variant of trustwallet.com A 188.114.96.3NS aldo.ns.cloudflare.com trustwalldt.com Bit flip Variant of trustwallet.com A 156.238.250.237NS a.share-dns.com trustwalle.com Missing character Variant of trustwallet.com A 13.223.25.84NS nsg1.namebrightdns.com trustwallet0.com Added character Variant of trustwallet.com NS a.share-dns.com trustwallet4.com Added character Variant of trustwallet.com A 156.238.250.124NS a.share-dns.com trustwallet5.com Added character Variant of trustwallet.com NS a.share-dns.com trustwallet6.com Added character Variant of trustwallet.com NS carla.ns.cloudflare.com trustwalleta.com Added character Variant of trustwallet.com A 172.65.185.109NS sp1.gname-dns.com trustwalleth.com Added character Variant of trustwallet.com NS a.share-dns.com trustwalletj.com Added character Variant of trustwallet.com NS a.share-dns.com
Showing 100 of 186
Related Infrastructure & Reports
Same registrar: NameSilo 6
Registered through the same registrar. A registrar serves millions of unrelated customers, so this groups reports rather than proving a link.
Recent threat reports 6
Recently added threat reports.
Check for cloaking
Compare what a browser and a crawler receive, and check for Keitaro traffic routing.
kalosfun.com Evidence & External Reports
Security Analysis
Submitted Evidence Snapshot
Sent: Ledger records: 1 Case ID:
PD-C9533574308C30B0C875 Recipient: abuse@namesilo.com Page title stored with report: Kalos Fun — NFT Marketplace, DEX Swap & Token Launchpad on Elysium
PDF notice generated
OSINT & Intelligence
DNS & Network
SEO & Domain
Deep Analysis
Help & reporting
Were You Affected by This Site?
5 evidence signal groups linked 1 stored notification records Last known active
You are not alone and there is nothing to be ashamed of. Scammers are sophisticated criminals who exploit trust. Reporting your experience is the most powerful weapon against fraud — your report can prevent others from becoming victims and help law enforcement take action. Silence is the scammer’s greatest advantage. Break it.
If credentials were compromised, report immediately. Do not engage with recovery scammers.
Act on what you actually did. Entered a password: change it, and wherever you reused it. Paid or gave card details: contact your bank or payment service. Downloaded a file: scan the device. Then report the incident.
Official reporting routes
FBI IC3
Report online Report internet-enabled crime in the United States
IC3 does not accept attachments. Keep original evidence for investigators. IC3 guidance
Federal tips line1-800-CALL-FBI
Action Fraud
Report online Report fraud and cybercrime in England, Wales and Northern Ireland
Current service: Report Fraud. England, Wales and Northern Ireland. Scotland: 101.
Contact centre0300 123 2040
Chainabuse
Report a crypto wallet, transaction, or phishing URL
SEAL-ISAC
Security Alliance crypto threat intelligence
More official reporting routes
FTC ReportFraud United States
Report scams and fraud to the US Federal Trade Commission. Reports go into a database used by law enforcement.
CISA United States
Report cyber incidents and phishing to the US Cybersecurity and Infrastructure Security Agency.
NCSC United Kingdom
Forward scam emails and text messages to the National Cyber Security Centre, which takes down the malicious sites it finds.
Emailreport@phishing.gov.uk Text messages7726
CSIRTs Network European Union
Directory of national incident response teams (CSIRTs) in the EU. Find the team for your country.
APWG Worldwide
Forward phishing emails to the Anti-Phishing Working Group.
Emailreportphishing@apwg.org
cybercrime.gov.in India
National Cyber Crime Reporting Portal. For financial fraud, also call the 1930 helpline straight away.
Helpline1930
PhishDestroy listing review Not a law-enforcement report
Domain Appeal
Request a review if you own this domain and believe the listing is incorrect
Report to Your Local Authorities
Select your country to get official cybercrime contacts, or create a complaint draft →.
If you made a payment, contact your bank or payment service through its official contacts as soon as possible. Keep the address, dates, payment or transaction details and messages for a report to the police or another competent authority. A report does not guarantee that money is returned.
Scammers are criminals. Filing a report creates a legal record and helps protect others.
97-country directory
Template-based draft • optional AI wording assistance requires separate consent
Review and submit it yourself
Recommendations & Advice for Victims
Choose the steps that match what you shared. Keep a copy of this report alongside your own records.
What should I do immediately?
Urgent
Stop using the suspicious site. Open the real service through its official app or an address you already trust.
- Entered a password — change it on that service and on every other site where you used the same password
- Turn on two-factor authentication — where the service offers it; an authenticator app is stronger than SMS codes
- Paid or entered card or bank details — contact your bank or payment service through the contacts on your card or its official website
What information should I collect for my report?
FBI guidelines
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
- Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
- Exact dates & times — of each transaction and first contact with scammer
- Screenshots — scam website, chat messages, emails, wallet transactions, social media
- All URLs & domains used by the scammer (including
kalosfun.com) - Communications — emails, texts, phone numbers, usernames the scammer used
Even if you don't have all details — file a report anyway. Partial information still helps investigations.
Where should I report the scam?
- FBI IC3 — Internet Crime Complaint Center (US federal reporting)
- Europol — European cybercrime reporting (EU)
- Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
- Local police — creates an official record, even if they can't act immediately
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
How do phishing scams typically work?
- Fake websites — pixel-perfect clones of legitimate sites with slightly altered domains
- Pig butchering — trust built over weeks via Telegram/WhatsApp/dating apps, then money stolen
- Recovery scams — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
- AI-powered scams — deepfakes, automated phishing, and AI-generated sites making fraud harder to detect
How can I protect myself in the future?
- Bookmark official sites — never click links from emails, DMs, or ads
- Verify domains — check on PhishDestroy before interacting. Check HTTPS, spelling, domain age
- "Too good to be true" = scam — guaranteed returns, celebrity endorsements, urgent deadlines
Further guidance: NIST · phishing responseFBI IC3 · reports & evidenceFTC · recovery scams
Check Any Domain
Threat analysis using stored blocklist, WHOIS, DNS, and public scan evidence
Scan NowReport Phishing
Submit suspicious domains to our threat database — protect the community
ReportLive Threat Feed
Recent phishing reports and observed availability changes
MonitorStay Informed, Stay Safe
Monitor live threats or contest this listing if you believe it's a false positive
Beware of recovery scammers! Recovery scammers may pose as investigators, lawyers, or tracing services. Do not pay upfront fees or disclose credentials. Learn more about recovery fraud →
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.