bonus-walletconnect[.]com

This domain, bonus-walletconnect.com, is confirmed as a crypto drainer phishing site designed to impersonate WalletConnect, a legitimate cryptocurrency wallet connection protocol. Analysis indicates the site employed the 'Wallet Connect Abuse' drainer kit, a toolset used to siphon digital assets from victims' wallets by exploiting deceptive transaction prompts. The domain was crafted to mimic WalletConnect's branding, increasing the likelihood of successful social engineering attacks against users seeking wallet integration services. Infrastructure analysis reveals the domain was registered through Dynadot LLC on December 1, 2025, and resolved to the IP address 188.114.97.3. At the time of assessment, the domain was flagged by 9 out of 95 security vendors on VirusTotal, indicating a high confidence level in its malicious nature. It appeared on a single security blocklist and was blocked by at least one threat intelligence feed. The domain's SSL certificate was issued by Google Trust Services, and it utilized Cloudflare's infrastructure, including HTTP/3 support, to obfuscate its true origin and evade detection. The page title, 'bonus-walletconnect.com | 504: Gateway time-out,' suggests recent takedown efforts or server instability. As of the latest assessment, bonus-walletconnect.com is offline, likely due to remediation actions such as domain suspension or server shutdown. However, the risk of re-emergence remains, as threat actors frequently rotate domains and infrastructure to resume operations. Users who interacted with this domain should immediately revoke any connected wallet permissions, audit transaction histories for unauthorized activity, and monitor for further phishing attempts. Organizations should update blocklists to include this domain and its associated indicators, including the IP address 188.114.97.3, to prevent future access. Continuous monitoring of related domains and drainer kit variants is recommended to mitigate residual risk.