ww25[.]new[.]checker-walletconnect[.]com

The domain ww25.new.checker-walletconnect.com is flagged as a brand‑impersonation site targeting WalletConnect. Infrastructure analysis shows the domain resolves to the IP address 199.59.243.228, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The domain is hosted on Amazon’s infrastructure, a common choice for short‑lived malicious sites. Name server records list ns1.managedns1.com, ns2.managedns1.com, ns1.priv4sys.com.iwantdemo.com and ns2.priv4sy, indicating use of third‑party DNS services that are often leveraged to obscure ownership.

The registration was performed through OwnRegistrar, Inc. on 26 November 2024, and the site currently returns an offline HTTP status with no SSL certificate present, which is typical for takedown or temporary suspension. The page title reported as "checker-walletconnect.com" matches the domain, but no further content analysis is available. Malware scanning on VirusTotal recorded detections from two of ninety‑five security vendors, and Gridinsoft assigns a trust score of zero out of one hundred, underscoring the malicious nature. The domain appears on one external blocklist and has been actively blocked by PhishDestroy.

Threat intelligence tags the site with a crypto‑scam profile and associates it with an "Airdrop Scam" phishing kit, suggesting that the adversary likely attempted to lure WalletConnect users with a fraudulent airdrop claim. Defenders should add the IP 199.59.243.228 and the full domain to perimeter blocklists, monitor for other domains using the same name‑server configuration, and enforce web‑filter rules that deny traffic to sites lacking TLS certificates associated with WalletConnect. Continuous monitoring of threat feeds for additional detections tied to the same phishing kit will help mitigate repeat abuse.