walllet-conectt[.]gitbook[.]io

This domain, walllet-conectt.gitbook.io, is identified as a credential phishing site specifically targeting users of WalletConnect, a protocol for connecting decentralized applications to mobile wallets. The site impersonates the legitimate WalletConnect v2.0 interface, presenting itself as a 'Bridge to Multi-Chain Wallets' to deceive victims into entering sensitive wallet credentials. As of the latest verification, the domain has been taken offline, though prior activity remains a documented threat. Analysis indicates the domain was flagged by 17 of 95 security vendors on VirusTotal, reflecting elevated detection rates. It was registered through Cloudflare, Inc. and resolved to the IP address 172.64.147.209, associated with AS13335 (Cloudflare, Inc.) in the United States. The domain creation date is listed as March 30, 2014, though this may reflect the registration of the parent gitbook.io platform rather than the subdomain itself. It appears on one security blocklist and was explicitly blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services (WE1), which does not mitigate the inherent risk of the impersonation. Current status confirms the domain is offline, reducing immediate exposure. However, historical activity and infrastructure reuse remain a concern. Organizations and users are advised to block the domain and IP 172.64.147.209 at the perimeter, update endpoint detection rules to include the domain and associated indicators, and monitor for credential reuse attempts. WalletConnect users should verify all connection prompts against the official domain (walletconnect.com) and enable multi-factor authentication where supported. Security teams are recommended to review logs for prior connections to this domain and conduct retrospective analysis for potential credential compromise.