kgv-schoener-fleck[.]de

Analysis of the domain kgv-schoener-fleck.de indicates active brand impersonation targeting WalletConnect, a cryptocurrency wallet connection service. The domain resolves to the IP address 193.34.145.201 and is hosted on infrastructure utilizing WordPress, MySQL, PHP, TypeScript, Leaflet, Apache HTTP Server, Moment.js, and jQuery Migrate. The page title, 'Schöner Fleck: Die offizielle Webseite des Kleingartenvereins "Schöner Fleck" in Kamen,' suggests a legitimate gardening association, which contrasts with the domain's classification as a high-risk threat due to its association with WalletConnect impersonation. As of July 12, 2026, the domain remains active and is flagged by 13 of 95 security vendors in VirusTotal scans. It appears in 16 threat intelligence pulses on AlienVault OTX and is blocked by at least two security blocklists, including PhishDestroy and BLP-Malware. The domain holds a Gridinsoft trust score of 0/100, further confirming its malicious classification. The SSL certificate is issued by Let's Encrypt, a common practice among both legitimate and malicious sites to avoid browser warnings. Infrastructure analysis reveals no clear attribution to a specific registrar or hosting provider, but the IP address and associated technologies align with patterns observed in previous phishing campaigns. The discrepancy between the page title and the reported impersonation of WalletConnect suggests either a compromised legitimate site repurposed for malicious activity or a deliberate attempt to obscure the true intent of the domain. Defenders are advised to treat this domain as high-risk and implement blocking measures at the network and endpoint levels. Organizations utilizing WalletConnect should alert users to avoid interacting with this domain and monitor for similar impersonation attempts. Further investigation into the hosting infrastructure and registrar details may provide additional context for takedown efforts.