de-xrp[.]live

This domain, de-xrp.live, is actively flagged as a high-risk phishing site impersonating WalletConnect, a protocol for secure blockchain connections. Analysis indicates the domain was registered on February 25, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and currently resolves to the IP address 188.114.97.3. The page title, 'WalletConnect - Secure Connection,' directly aligns with the targeted brand, suggesting an intent to deceive users into believing the site is legitimate. The domain is blocked by at least four security vendors, including SEAL, MetaMask, PhishDestroy, and BLP-Malware, and holds a Gridinsoft trust score of 0/100. Additionally, it appears in 14 threat intelligence pulses on AlienVault OTX, reinforcing its malicious classification. Infrastructure analysis reveals the use of a Let's Encrypt SSL certificate, a common tactic among phishing sites to appear secure. While the exact content and functionality of the site remain unanalyzed, the combination of brand impersonation, active security blocklisting, and low trust scores confirms its role in phishing operations. Defenders should treat this domain as hostile and prioritize blocking or monitoring any interactions with it. The site remains active as of July 12, 2026, and no takedown or mitigation efforts have been observed. Further investigation into associated infrastructure, such as hosting providers or connected domains, may uncover additional threats linked to this campaign.