kelpdao[.]com-connect-wallets-v2-app[.]com

Analysis of the domain kelpdao.com-connect-wallets-v2-app.com indicates it was actively used as a crypto drainer infrastructure, impersonating a wallet connection service associated with the KelpDAO brand. The domain was registered on February 21, 2026, and has since been taken offline, returning an 'Access Denied' page title. Infrastructure analysis reveals the domain resolved to the IPv6 address 2a06:98c1:3120::3, hosted on Cloudflare's network (AS13335) in the United States. The SSL certificate was issued by WE1, a common provider for both legitimate and malicious domains, offering no definitive classification on its own.

Detection data shows the domain was flagged by three of 95 security vendors on VirusTotal and appears on one security blocklist, specifically PhishDestroy. Gridinsoft assigned a trust score of 0/100, reinforcing its classification as malicious. The scam type is explicitly identified as a crypto scam, consistent with the domain's naming pattern, which suggests an attempt to deceive users into connecting wallets for unauthorized fund transfers. While the domain is currently offline, defenders should treat any future resolution or re-registration of this domain or similar variants as high-risk.

Historical DNS and WHOIS records should be preserved for forensic analysis, and security teams are advised to block the domain and its associated IP at the perimeter. The 'Access Denied' status may indicate takedown efforts or temporary suspension, but the infrastructure remains a potential threat until fully dismantled. No additional page content or phishing kit details are available for further classification.