swap-wallet-connect-multichain-v3[.]znyrgl[.]com

This domain, swap-wallet-connect-multichain-v3.znyrgl.com, is currently under investigation for brand_impersonation targeting WalletConnect, a widely used protocol for connecting decentralized applications to cryptocurrency wallets. The domain appears to mimic legitimate WalletConnect infrastructure, potentially aiming to deceive users into disclosing sensitive credentials or authorizing malicious transactions. No specific drainer kit has been identified at this stage, though the page title 'Problem loading page' suggests either a placeholder or an obfuscation tactic to evade automated detection systems. Infrastructure analysis reveals the following technical indicators: the domain resolves to the IP address 188.114.97.3 and was registered through Gname.com Pte. Ltd. on October 21, 2017. Despite its age, the domain has not been flagged by Google Safe Browsing (GSB) and currently shows 0 detections out of 95 engines on VirusTotal. The SSL certificate is issued by FASTPANEL, a common hosting control panel, which does not inherently indicate malicious activity but is often observed in low-effort phishing setups. No blocklist entries have been recorded at this time, though the lack of detections may reflect the domain's recent activation for malicious purposes rather than benign use. As of the latest assessment, the domain remains active and unresolved by security vendors. The absence of detections does not preclude malicious intent, particularly given the domain's impersonation of a high-value cryptocurrency brand. Users are advised to exercise caution when encountering this domain, particularly if prompted for wallet credentials or transaction approvals. Organizations should monitor for connections to 188.114.97.3 and consider preemptive blocking of the domain to mitigate potential credential theft or unauthorized asset transfers. Further investigation is warranted to determine the full scope of the campaign and any associated infrastructure.