claim-kelpdao[.]co

Analysis of claim-kelpdao.co shows that the domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com and created on 25 October 2024. The authoritative nameservers are mckenzie.ns.cloudflare.com and trace.ns.cloudflare.com, directing the domain to the Cloudflare‑owned address 188.114.96.3, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. No SSL certificate is presented, indicating that the site does not offer HTTPS encryption. The only observable page element is the title “Nur einen Moment…”, which provides no indication of legitimate content. The domain is flagged as a crypto‑scam and explicitly listed as impersonating the brand “kelp”.

It has been added to a single security blocklist and is currently blocked by PhishDestroy. A VirusTotal scan involving 95 vendors returned no detections, but the absence of alerts does not constitute a safety guarantee. The domain’s status is reported as offline at the time of assessment. While the infrastructure points to a typical Cloudflare‑fronted malicious hosting pattern, the lack of a TLS certificate and the presence of a generic title suggest a placeholder or redirect page commonly used in brand‑impersonation campaigns.

Uncertainty remains regarding the exact payload or phishing pages that may have been served before the takedown, as no additional content hashes, URL paths, or phishing kit identifiers have been disclosed. Defenders should continue to enforce blocklist rules for claim‑kelpdao.co, monitor any future DNS changes, and consider adding the domain to internal watchlists. Network sensors should flag any outbound connections to 188.114.96.3 from user devices, and email filters should treat messages referencing the “kelp” brand with heightened scrutiny. Ongoing observation of Cloudflare‑associated IP ranges for similar newly registered domains is recommended to catch emerging impersonation attempts.