rseth[.]org

The domain rseth.org is flagged for brand impersonation, specifically targeting the Kelp brand. The domain impersonates Kelp's services by using a page title that reads 'Liquid restaking | Restake ETH or LSTs, mint rsETH and earn Kelp Miles!', which could mislead users into believing they are interacting with a legitimate Kelp service. No specific drainer kit has been identified, but the domain's structure and content suggest a sophisticated attempt to mimic Kelp's offerings.

Infrastructure analysis reveals that the domain rseth.org has a VirusTotal detection score of 4/95, indicating that a small number of security vendors have identified it as malicious. The domain is registered through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the IP address 104.21.64.1. It was created on September 15, 2025, and is currently listed as taken offline. The domain appears on three security blocklists and has a Gridinsoft trust score of 0/100, further corroborating its malicious nature. Additionally, the domain is mentioned in one threat intelligence pulse on AlienVault OTX.

Currently, the domain rseth.org is offline, which mitigates the immediate risk to potential victims. However, the domain's presence on multiple blocklists and the low trust score suggest that it has been actively used for malicious activities. Organizations and individuals should remain vigilant and avoid any engagement with this domain. Security teams are advised to monitor for any reactivation of the domain and to update their threat intelligence databases accordingly to ensure continued protection against potential brand impersonation attacks targeting Kelp.