wallett-connect[.]github[.]io

This domain, wallett-connect.github.io, presents a high-risk brand impersonation threat specifically targeting cryptocurrency users through a fraudulent WalletConnect portal. Analysis of the page title, 'Wallet Connect | Кошельки, совместимые с Wallet Connect,' reveals the domain is designed to deceive Russian-speaking users into believing they are accessing a legitimate WalletConnect-compatible wallet service. The primary threat involves credential harvesting, where victims are prompted to connect their crypto wallets, unknowingly exposing private keys or recovery phrases to attackers. This type of attack enables immediate unauthorized access to cryptocurrency holdings, leading to potential financial theft and irreversible asset loss. Infrastructure analysis reveals multiple concrete indicators of malicious activity. The domain is flagged by 16 out of 95 security vendors on VirusTotal, a notably high detection rate for phishing infrastructure. It resolves to the IP address 185.199.110.153, associated with GitHub Pages hosting, and is registered through GitHub, Inc., leveraging the platform's legitimate services to evade initial suspicion. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and is explicitly labeled as phishing by Google Safe Browsing. The SSL certificate, issued by Let's Encrypt (R12), further mimics legitimate services, increasing the likelihood of user deception. The combination of these technical indicators, particularly the high VirusTotal detection rate and blocklist presence, underscores the domain's active and deliberate malicious intent. Users who have visited wallett-connect.github.io or interacted with its content should take immediate action to mitigate potential compromise. First, disconnect any wallets that were linked to the domain and revoke all associated permissions using the official WalletConnect interface or the wallet's native settings. Conduct a thorough review of transaction history for any unauthorized activity, particularly focusing on outgoing transfers or approvals granted during the suspected compromise window. If credentials, private keys, or recovery phrases were entered, assume the wallet is fully compromised and transfer remaining assets to a new, secure wallet with a fresh seed phrase. Monitor connected accounts and enable additional security measures, such as multi-factor authentication, where applicable. Given the domain's active status and high-risk classification, users should also report the incident to relevant security teams and consider sharing indicators of compromise with the broader cybersecurity community to aid in threat disruption.