kelpdao[.]com-chain-v3[.]com

The domain kelpdao.com-chain-v3.com was registered on February 21, 2026 through Web Commerce Communications Limited and is currently taken offline. DNS resolution points to the IPv6 address 2606:4700:3030::6815:48f7, which belongs to Cloudflare’s network (AS13335, United States). The authoritative nameservers are dane.ns.cloudflare.com and kami.ns.cloudflare.com, confirming that the site leveraged Cloudflare’s edge services, including HTTP/3 support. TLS termination is performed by a certificate issued by Google Trust Services under the WE1 label, indicating a valid, publicly trusted certificate chain.

An HTTP request returned a 403 Forbidden page title, suggesting that the underlying web server is configured to deny access, but the title itself was captured before the site was taken offline. VirusTotal analysis shows that nine of ninety‑three scanned security vendors flagged the domain as malicious, providing independent corroboration of suspicious activity. Independent blocklist operators PhishDestroy and ScamSniffer have added the domain to their phishing blocklists, bringing the total number of known blocklist entries to two. The observed technology stack (Cloudflare, HTTP/3) and the presence of a valid Google‑issued certificate are consistent with recent phishing infrastructure that seeks to appear legitimate while relying on third‑party hosting.

What remains uncertain is the specific payload or credential‑capture mechanism, as no page content beyond the 403 title was retrieved. Defenders should continue to block the domain at network perimeter devices, update URL filtering and threat intelligence feeds with the observed indicators, and monitor for any re‑appearance of the domain or associated IP address. Because the certificate is publicly trusted, endpoint security solutions should treat any HTTPS request to this host as high‑risk until the domain is definitively retired.