# walletconnect.live — MALICIOUS

> Avoid walletconnect.live to protect your crypto assets. This phishing site targets Web3 users. Stay safe by not visiting or sharing sensitive info.

## Summary
PhishDestroy identifies walletconnect.live as a high-risk crypto drainer phishing domain exploiting Web3 users with fake Walletconnect airdrop claims. The page entices victims to unlock supposed cryptocurrency benefits, aiming to steal funds.

This domain was created on February 21, 2026, resolving to IP 188.114.97.3 and has been listed on two security blocklists. VirusTotal flags it as malicious by 13 out of 95 security vendors. The campaign leverages an appealing page title to lure victims.

Currently offline, walletconnect.live poses a significant threat while active. Users are advised to avoid interacting with the site or providing wallet credentials. Continuous monitoring and blocking of associated infrastructure are recommended.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 0)
- Page title: Unlock Web3 Potential with Walletconnect Airdrop WC Today!

## Domain Intelligence
- Registered: 2026-02-21 07:01:08
- IP: 188.114.97.3
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: ["nucum.ns.cloudflare.com", "anton.ns.cloudflare.com"]
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 13 vendors flagged
  Vendors: ["ADMINUSLabs", "ChainPatrol", "alphaMountain.ai", "BitDefender", "CyRadar", "ESET", "Forcepoint ThreatSeeker", "Fortinet", "G-Data", "Lionic", "Seclookup", "Sophos", "VIPRE"]
- Google Safe Browsing: clean
- Blocklists: 2 hits
  Lists: ["PhishDestroy", "MetaMask"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019b8ebf-0697-7318-9f02-5109a8d76c16.png
- PhishDestroy: https://phishdestroy.io/domain/walletconnect.live/
- LLM endpoint: https://phishdestroy.io/domain/walletconnect.live/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/walletconnect.live/
Last updated: 2026-03-19