wallet--coin[.]net

Analysis indicates that the domain wallet--coin.net is being used to impersonate the WalletConnect brand in a crypto‑related scam. The site was registered on June 30, 2025 through Gname.com Pte. Ltd. and resolves to the IP address 18.175.156.185, which is hosted by Amazon.com, Inc. in the United Kingdom (AS16509). An SSL certificate identified as R11 is present, but no additional certificate details are available. The page title returned by the server is simply "wallet," and no further content has been publicly disclosed, leaving the exact phishing page layout unknown.

The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service, suggesting that at least one defensive feed has identified it as malicious. AlienVault’s Open Threat Exchange lists the domain in one threat‑intel pulse, providing corroborating community‑based evidence of its malicious nature. Gridinsoft assigns the domain a trust score of 0 out of 100, indicating a complete lack of trust. VirusTotal scans show that nine of ninety‑three security vendors flagged the domain, reinforcing the suspicion of malicious activity despite the relatively low detection count.

The overall risk assessment is elevated, and the domain’s current status is offline, which may indicate takedown or temporary suspension. Defenders should continue to block the domain and its associated IP address, add the host to internal deny lists, and monitor for any re‑hosting attempts. Network sensors should be configured to alert on connections to the IP range owned by AS16509, and security teams should review any logs for attempted communications with wallet--coin.net. Given the brand impersonation and crypto‑scam classification, organizations handling WalletConnect credentials or cryptocurrency transactions should treat any exposure to this domain as a high‑severity incident and initiate appropriate response procedures.