walletconnect-check275641[.]cfd

Analysis of the domain walletconnect-check275641.cfd indicates it was established as a crypto scam infrastructure targeting WalletConnect users. The domain, registered on September 29, 2025, through Web Commerce Communications Limited, resolved to IP address 172.67.143.155, hosted on Cloudflare's network (AS13335) in the United States. No SSL certificate was detected, increasing the risk of interception or manipulation of user data. The page title 'WalletConnect $205 Check' suggests an attempt to lure victims with a fabricated financial incentive, a common tactic in crypto-related fraud schemes.

Security vendors have flagged this domain on multiple blocklists, with PhishDestroy and ScamSniffer both listing it as malicious. At the time of assessment, the domain appears on two security blocklists, and eight of 95 security vendors on VirusTotal identified it as suspicious. The domain is currently offline, though its prior activity and detection history warrant continued monitoring. Infrastructure analysis reveals the use of Cloudflare nameservers (jason.ns.cloudflare.com and lady.ns.cloudflare.com), a frequent choice for threat actors seeking to obscure hosting origins and evade takedowns.

Defenders should treat this domain as part of a broader pattern of WalletConnect impersonation campaigns. While the exact content of the site remains unanalyzed, the combination of a suggestive page title, absence of SSL, and detection by multiple security vendors confirms its malicious intent. Organizations are advised to block the domain at the DNS or proxy level and monitor for related infrastructure, particularly domains using similar naming conventions or hosted on the same IP range. Given the domain's registration date and detection timeline, it may have been active for several months before being taken offline, underscoring the need for retrospective log analysis to identify potential prior compromises.