xlkndza[.]squidvr[.]com

This domain, xlkndza.squidvr.com, is identified as a phishing resource designed to impersonate WalletConnect, a widely used protocol for connecting decentralized applications to cryptocurrency wallets. Analysis indicates the site presents a fraudulent interface under the page title 'BIT Mining,' likely intended to deceive users into entering wallet credentials or authorizing malicious transactions. The use of cryptocurrency-themed lures aligns with observed tactics in credential harvesting and unauthorized fund transfers, posing a direct financial risk to visitors. Infrastructure analysis reveals multiple technical indicators supporting its malicious classification. The domain was registered on October 13, 2021, through Dynadot LLC and currently resolves to the IP address 104.21.53.189, which is associated with Cloudflare’s content delivery network. Detection metrics show the domain is flagged by 11 out of 95 security vendors on VirusTotal and appears on two independent security blocklists. Additional telemetry indicates it is actively blocked by at least two real-time phishing detection systems. The SSL certificate is issued by Google Trust Services, and the site employs Facebook Pixel and HTTP/3, suggesting an attempt to mimic legitimate web infrastructure. Users who have visited xlkndza.squidvr.com or interacted with its content are advised to take immediate remedial actions. Any entered credentials or wallet authorizations should be considered compromised and revoked through the legitimate WalletConnect interface. Connected wallets must be audited for unauthorized transactions, and all active sessions should be terminated. It is recommended to monitor associated accounts for suspicious activity and update authentication credentials across platforms where similar passwords may have been reused. No further interaction with the domain should occur, and any cached redirects should be cleared from browser data.