def999[.]net

This domain, def999.net, is actively flagged as a high-risk phishing infrastructure targeting WalletConnect, a known cryptocurrency wallet connection service. Registered on September 16, 2025, through Domain International Services Limited, the domain currently resolves to the IP address 188.114.96.3, which is protected by Cloudflare’s network. Analysis indicates the use of HTTP/3 and a Google Trust Services SSL certificate, suggesting an attempt to appear legitimate while leveraging modern web technologies to evade detection. The domain’s trust scores are critically low, with Gridinsoft assigning a 1/100 rating and Scamadviser a 15/100, reinforcing its classification as malicious. Infrastructure analysis reveals that def999.net is present on three security blocklists and has been flagged by 10 out of 95 security vendors in VirusTotal scans. Additional threat intelligence confirms its inclusion in 23 pulses on AlienVault OTX, further validating its association with malicious activity. The domain is explicitly blocked by at least three security tools, including ScamSniffer and PhishDestroy, which specialize in identifying phishing and fraudulent sites. Despite these indicators, the domain remains operational as of July 12, 2026, posing an ongoing risk to users. What remains uncertain is the exact content or functionality of the site, as no page title or detailed forensic analysis of the phishing kit has been provided. However, given the domain’s registration details, hosting infrastructure, and the consistent flagging by multiple security sources, it is reasonable to classify this as a deliberate impersonation of WalletConnect. Defenders should treat this domain as hostile and prioritize blocking it at the network level, particularly in environments where cryptocurrency-related services are accessed. Monitoring for related domains registered through the same provider or resolving to the same IP range may help identify additional threats in this campaign.