easywalletconnect[.]com

Analysis of easywalletconnect.com shows a high‑risk brand‑impersonation campaign targeting WalletConnect. The domain was registered through GMO Internet Group, Inc. d/b/a Onamae.com and created on June 16 2025. It resolves to a single IPv4 address, 185.100.87.82, located in Romania and announced by AS200651 FlokiNET ehf. The hosting stack reports Nginx with OpenResty, and the site presents an SSL certificate issued by GoDaddy.com, Inc. under the Go Daddy Secure Certificate Authority – G2.

Current HTTP response indicates the site is offline with the page title “Account Suspended.” VirusTotal scans have flagged the domain in 17 of 95 security‑vendor engines, and AlienVault OTX references it in two threat‑intel pulses. Independent reputation services assign extremely low scores: Gridinsoft trust 0 / 100 and Scamadviser 1 / 100. The domain appears on four known security blocklists and is explicitly blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura.

The combination of a recent registration date, single‑nameserver configuration, low‑reputation scores, and multiple vendor detections strongly suggests a malicious intent to deceive WalletConnect users, likely to harvest credentials or funds in a crypto‑scam context. Defenders should immediately block the domain at perimeter and DNS layers, monitor for any outbound connections to the listed IP address, and ensure that any user‑facing WalletConnect integrations enforce strict URL validation. Ongoing threat‑intel feeds should be consulted for updates, and any related indicators of compromise should be added to security monitoring rules to mitigate potential abuse.