coinbase-wallet-connect--realelidooro[.]replit[.]app

coinbase-wallet-connect--realelidooro.replit.app is a malicious site posing as a legitimate WalletConnect service, specifically targeting users with the false promise of an ETH wallet connection. PhishDestroy’s analysis confirms this domain is part of an active brand impersonation campaign designed to deceive visitors into connecting their cryptocurrency wallets to a fraudulent service, likely for fund theft or credential harvesting. The threat actor leverages the trusted name of WalletConnect, a well-known protocol for connecting wallets to decentralized applications, to lend credibility to the scam and trick users into granting unauthorized access to their digital assets. PhishDestroy identifies this domain as high-risk due to multiple confirmed indicators of malicious intent. The site was flagged by two independent security blocklists and is currently resolving to IP address 34.117.33.233. Notably, it has not yet been detected by VirusTotal’s 95 scanning engines, which is not uncommon for newly deployed phishing domains. The domain was registered under a hosting service associated with rapid deployment of malicious infrastructure, further suggesting opportunistic misuse of reputable platforms like Replit.app. The SSL certificate, issued by Google Trust Services, adds a false layer of legitimacy, tricking users into believing the connection is secure. Additionally, security tools such as MetaMask and SEAL have already blocked access to this domain, confirming its malicious nature. If you have visited coinbase-wallet-connect--realelidooro.replit.app, immediately disconnect your wallet from the site and revoke any permissions you may have granted using a trusted blockchain explorer like Etherscan or a secure wallet interface. Do not interact further with the domain, as it may attempt to drain your cryptocurrency or steal private keys. Run a full malware scan on your device using updated antivirus software. Report the incident to the real WalletConnect team via their official website and to your local cybercrime unit if significant losses occurred. Always verify URLs and use bookmarked links or official apps to access services like WalletConnect. PhishDestroy advises users to double-check domains against its database before entering any credentials or connecting wallets.