Cerca i domini monitorati ed esamina le prove archiviate, i rilevamenti e gli ultimi dati relativi alla disponibilità osservata.
196,410
Totale monitorato
196,410
VT rilevato
94,369
Ultima visualizzazione: attivo
99,909
Non disponibile all'ultimo controllo
0
VT In attesa di conferma
How This Attack Works
WalletConnect Abuse involves deceptive tactics to exploit users of cryptocurrency platforms. Understanding these steps can help in prevention.
STEP 1
Creation of Fake Domini
Attackers create fake domains that mimic legitimate cryptocurrency platforms to lure victims.
STEP 2
Deployment of Phishing Pages
Phishing pages are set up on these domains to capture user credentials and wallet information.
STEP 3
Execution of Malicious Code
JavaScript and other scripting languages are used to execute malicious code that intercepts user data.
STEP 4
Unauthorized Transactions
Stolen credentials are used to authorize transactions, draining victims’ wallets.
Technical Analysis
WalletConnect Abuse often involves the creation of phishing sites that mimic popular cryptocurrency service providers. Attackers use sophisticated scripts to manipulate the WalletConnect protocol, intercepting the authentication process. This includes the use of JavaScript to capture private keys and signatures when users attempt to connect their wallets. Infrastructure-wise, attackers frequently utilize content delivery networks like Cloudflare to host phishing sites, taking advantage of high availability and speed. Additionally, smart contracts are sometimes manipulated to automatically approve transactions that transfer funds to the attacker’s address without the victim's explicit consent.
Real Cases
The Opensea Phishing Incident (2024)
$2 million stolen
A phishing campaign targeting Opensea users resulted in significant financial losses and credential theft.
Vercel App Scam (2023)
$1.5 million stolen
Attackers used fake Vercel app domains to trick users into revealing wallet information, leading to unauthorized access.
Marketplace-Art Fraud (2024)
$3 million stolen
Fraudulent marketplace-art domains were used to deceive users into connecting their wallets, resulting in asset theft.
How to Detect
Unfamiliar domain names mimicking legitimate services
Requests for private keys or seed phrases
Unexpected transaction requests
Poor website design or misspellings
Limited or no HTTPS security
How to Protect Yourself
1
Always verify domain authenticity
2
Enable two-factor authentication
3
Use hardware wallets for transactions
4
Regularly update security software
5
Educate yourself on common phishing tactics
Frequently Asked Questions
Data sourced from PhishDestroy threat intelligence database — 1,673 domains tracked for this threat type
WalletConnect Abuse 1,673 domains
amlmikser.com
amlreviewpro.top
amlsavecheck.com
anoma.claiming.ink
app-hyprrswap.com
app.loomlay.com
app.ray.sx
arclaim.com
asterscore.com
babydogeswap.org
bitcoinpepe.co
bitget.biz
bixplorer.pages.dev
blockdag-networknets.web.app
bob-mainnet-git-feat-bob-ccip-bridge-distributed-crafts.vercel.app
bob-mainnet-n6hqrktcs-distributed-crafts.vercel.app
bob-sepolia-jbjpojtid-distributed-crafts.vercel.app
bob-sepolia-jpd0ed4is-distributed-crafts.vercel.app
bob-sepolia-xjyou1aaz-distributed-crafts.vercel.app
bridge.puslechain.cc
bridgemegaeth.io
build.assiterr.space
build.assiterr.xyz
butikland.com
bytedrop.org
cahtnode.com
cc6iu-iqaaa-aaaap-qpxpa-cai.icp0.io
changenow.id
claim-apriori.site
claim-belong.site
claim-reward-bybit.com
claim-sapien.xyz
claim.node-hub.net
claim.ticketsesh.com
claimspacepaytoken.live
clear-chat.ai
collab.entrance-land.com
comming.soo.network
connecttopro.us
cypher-voting.com
dapps-debug.web.app
dare.market
dayhub.io
defidapp-protocol.web.app
dytel-jyaaa-aaaam-ae6va-cai.icp0.io
edel-airdrop.com
eligibility-edel.com
evm.onchainwalletcrypto.com
family.banksonbase.com
findyourtoken.cx
fineturtle.com
finmate.invoicemate.net
fir10.209494.com
fund.airdropacres.com
funnydex.com
gasspas-vip.web.app
governance-uniswap.com
hepyrlandfenence.org
heyanon-ai-interface-git-feature-zodiac-widget-real-wagmi.vercel.app
hilltonscreener.com
hrdzes.com
hybrafinance.com
hyperliquid.com-portal-connects-secure-prod.pro
ib67n-yiaaa-aaaao-qjwca-cai.icp0.io
interswap-refund-prod.pages.dev
ipdefi.netlify.app
ipypb.cc
itconsultinghelpdesk.com
j-dex-v4.app
kiberswap.com
kinetiq-foundations.org
layerbrett.com
leotec.app
liberlaunch.net
libertywsap.finance
lidoapp.pages.dev
lxlwyn.top
malenerosenberghansen.com
manyushiba.xyz
mask-eligibility.app
memepartyoneth.xyz
migrate-yield.com
migrate-yieldbasic.com
moon048.94tp.com
mysterybox-ethereum.vercel.app
nftstrategy-votes.com
nkyfp-kyaaa-aaaaj-az62q-cai.icp0.io
nlrwvf.pages.dev
o4xfd-oiaaa-aaaaj-qnsaa-cai.icp0.io
okxclaim.web.app
online232.com
onyx-token.com
orcamind.ai
originndefi.org
origndefi.org
oz5wg-liaaa-aaaap-qb43a-cai.icp0.io
pad-chain-gpt.org
panther-guard.web.app
pape-drops.netlify.app
Pipeline di risposta alle minacce
Come vengono verificati tutti i domini presenti in questo hub e come vengono neutralizzate le minacce confermate. Visualizzazione completa della pipeline →
Controlli relativi alle informazioni sulle minacce— ogni dominio viene analizzato e sottoposto a verifica incrociata rispetto a:
urlscan.ioScreenshot · DOM · HTTPVirusTotal90+ AV enginesGoogle Safe BrowsingTransparency RelazioneCloudflare RadarDNS · certs · categoriesAlienVault OTXThreat-intel pulsesWayback MachineHistorical evidenceabuse.ch ThreatFoxIOC correlationcrt.shCertificate TransparencyDNS Sicurezza FiltersQuad9 · AdGuard · CleanBrowsingWeb-ControllaFull surface scan
crt.shSincronizzazione globale dei fornitori— i rilevamenti confermati vengono trasmessi a 29 partner:
GoogleSafe BrowsingGoogleWeb Risk APIMicrosoftSmartScreenVirusTotalDetection feedCloudflareRadar / 1.1.1.1YandexSafe BrowsingURLScan.ioPublic scanESETWebGuardBitdefenderThreat exchangeNortonSafe WebSymantecRecensione del sitoAviraCloud detectionAvast / AVGWeb ShieldKasperskyOpenTIPDr.WebOnline scannerNetcraftRimozione APIPhishTankVerified voteAPWG eCXBulk feedPhishStatsOpen feedPhish.RelazioneHosting abuseSpamhausDBL feedPolySwarmMarketplaceCheckPhishBolster scanQutteraMalware scanURLquerySandboxCriminal IPAsset intelCRDFThreat CenterScamadviserTrust scoreMyWOTWeb of Trust