ledger-crypto-wallet-connect[.]com

PhishDestroy identifies ledger-crypto-wallet-connect.com as a live brand-impersonation domain designed to deceive cryptocurrency users by mimicking WalletConnect, a legitimate protocol for connecting wallets to decentralized applications. When victims land on the page they are presented with realistic-looking WalletConnect branding and dialogs that urge them to “connect” a wallet—in reality handing full control of their digital assets to the attackers. Because WalletConnect is widely used for NFT marketplaces, DeFi platforms, and Web3 gaming, the domain preys on users who expect to see a familiar, secure interface. This domain was flagged by exactly 2 out of 95 VirusTotal security vendors at the time of analysis. It resolves to IP address 172.67.151.95, uses a Let’s Encrypt SSL certificate to appear legitimate, and was registered through Hello Internet Corp on February 24, 2026—just days before the assessment. The combination of a newly minted domain, low detection rate, and exact brand replication is a hallmark of a fast-evolving phishing campaign aimed at draining crypto wallets within hours of going live. If you visited ledger-crypto-wallet-connect.com, immediately disconnect any connected wallet, revoke any permissions you may have granted, and transfer remaining funds to a fresh wallet you control. Scan your device with an up-to-date antivirus and consider rotating all private keys or seed phrases that were ever entered on the site. Report the domain to your wallet provider and to the legitimate WalletConnect team so they can add it to blocklists. Finally, bookmark the real WalletConnect URL (walletconnect.com) to avoid similar typosquat traps in the future.