connect[.]globaltranstrack[.]info

Analysis of connect.globaltranstrack.info was performed on July 25, 2026. The domain was registered on March 12, 2026 and is currently taken offline, preventing live verification of its content. Historical observations indicate the site presented the page title “Crypto Wallet Connect | Secure Your Assets,” which aligns with a brand‑impersonation attempt targeting the WalletConnect service. The domain resolves to IP address 192.142.10.129, an address located in the Netherlands and assigned to AS214036 (Ultahost, Inc.).

No TLS certificate was observed, meaning connections were made over plain HTTP, and the server identified LiteSpeed with HTTP/3 support. The site appears on three public security blocklists and has been explicitly blocked by the PhishDestroy, MetaMask, and SEAL filtering services. VirusTotal scans show three of ninety‑four anti‑malware engines flagged the domain, confirming that at least a minority of vendors consider it malicious. The classification in the intelligence feed is “Crypto Scam,” consistent with the WalletConnect impersonation vector.

Because the domain is offline, the current page content cannot be inspected, and the exact phishing flow (e.g., credential capture or transaction redirection) remains unknown. Defenders should continue to deny any network connections to 192.142.10.129, add the domain to deny‑list rules in DNS and proxy solutions, and monitor for newly registered domains that reuse the “globaltranstrack” label or mimic the WalletConnect brand. Additional hunting can focus on other domains hosted by the same ASN or using LiteSpeed/HTTP/3 configurations without TLS, as these factors have been observed in related crypto‑focused impersonation campaigns. Ongoing feed updates should be checked for any re‑appearance of the domain or related indicators.