cryptofixer[.]online

Analysis of cryptofixer.online, observed to be offline as of the reporting date, indicates it was registered on 18 November 2025 through Spaceship, Inc. The domain resolves to IP 140.99.164.68, which is allocated to Brazil and associated with ASN 396356 (Latitude.sh). No TLS certificate is present, meaning the site would have been served over plain HTTP. The page title returned by the server is “WalletConnect”, matching the declared brand target, and the domain is explicitly listed as impersonating WalletConnect. VirusTotal scans show that two of ninety‑five antivirus or URL‑reputation engines flagged the domain, providing a modest detection signal.

Independent blocklist providers PhishDestroy and ScamSniffer have already added the domain to their phishing feeds, and the domain appears on two additional security blocklists, reinforcing the malicious classification. Nameserver records point to launch1.spaceship.net and launch2.spaceship.net, consistent with the registrar information. Because the site is currently offline, content‑level analysis (HTML structure, credential‑capture forms, or JavaScript payloads) cannot be confirmed, and the exact phishing kit used remains unknown. Defenders should treat the domain as a confirmed WalletConnect impersonation and incorporate the host IP and domain into intrusion‑prevention, DNS filtering, and endpoint web‑reputation controls.

Monitoring for newly registered domains that resolve to the same IP range or share the Spaceship, Inc. registrar may help detect future replicas. Updating detection signatures to flag the “WalletConnect” page title in conjunction with the observed IP or nameserver pattern is also recommended. Continuous re‑query of VirusTotal and blocklist feeds is advised to capture any changes in detection status.