This site is a crypto wallet drainer that impersonated WalletConnect, the widely used wallet-connection protocol trusted across decentralised finance. It targeted cryptocurrency holders by presenting a convincing fake wallet-connection interface. PhishDestroy first detected it on 2026-09-14, roughly five weeks after the domain was registered. The site went offline on 2026-09-16 and remains dead as of 2026-10-17.
How the scam works
The page operated under the title "Wallet Connect," closely mirroring the real WalletConnect brand to persuade visitors they were using a legitimate service. When a user connects their wallet to such a fake interface, the drainer silently requests sweeping token approvals or crafts malicious signing requests in the background. Assets — tokens, NFTs, or native currency — are then transferred to attacker-controlled addresses within seconds, often before the victim notices anything wrong.
Evidence
On 2026-09-15, eleven of 89 engines on VirusTotal flagged this domain as malicious, with confirmed detections from BitDefender, Kaspersky, ESET, Fortinet, G-Data, CRDF, Forcepoint ThreatSeeker, and alphaMountain.ai. urlscan.io independently returned a malicious verdict and identified WalletConnect as the impersonated brand. The domain is listed on the PhishDestroy blocklist. The detection rate is moderate rather than near-universal, but the agreement across multiple reputable vendors and an independent scanner provides solid backing for the classification.
Infrastructure
The domain was registered on 2026-08-11 through Namecheap Inc as a subdomain of nexusqalinka2.lol, a structure commonly used to generate large numbers of unique-looking drainer URLs from a single parent domain. Traffic is routed through Cloudflare's network, with hosting attributed to Canada. The TLS certificate was issued by Google Trust Services under the WE1 intermediate, giving the page a padlock that could mislead security-conscious users.
What to do
If you visited this site and connected your wallet, act immediately: use a trusted on-chain approval checker to revoke every token approval granted around the time of the visit, then move remaining assets to a freshly generated wallet address. Do not continue using a wallet that signed any transaction on this site. Check your transaction history for unexpected outbound transfers and report them to your wallet provider. Security teams should block the nexusqalinka2.lol parent domain at the DNS and network layer to cover any sibling subdomains.
For the registrable domain nexusqalinka2.lol behind this subdomain, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Certificate fingerprint4a6d8b81a3b735242211f80395f819f486ff9f8ab3940657b35818fcf674ed41Certificate names · 1 SANs
nexusqalinka2.lol
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Primary outcomeDNS 非アクティブreason: DNS NXDOMAIN80% confidence
Attributionsource: Dns Cache
Evidence layersAvailability: DNS inactiveContent: UnreachableDNS: NXDOMAINRegistration: Unknown
Latest HTTP observation不明Probe Inconclusive20%2026-10-19 01:14:29 UTC
RDAP registration不明
Observed timelinelast reachable: 2026-09-15 22:17:59 UTCcurrent episode first observed: 2026-09-30 16:14:55 UTCobserved RIP window: 2026-09-15 22:17:59 UTC → 2026-09-30 16:14:55 UTC · 353.95hmidpoint estimate ≈ 2026-09-23 07:16:27 UTC · precision low · basis bounded
Availability, content, DNS and registration are independent evidence layers. NXDOMAIN, an unreachable origin or missing content alone does not prove registrar action. A registrar or provider is credited only when a direct technical marker identifies that actor. Report causality is shown separately.
使用技術 · 3 identified
Cloudflare Browser Insights
AnalyticsRUM
Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users.
Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(US)
