wallnetsconnects[.]live

The domain wallnetsconnects.live has been identified as a brand impersonation threat specifically targeting WalletConnect, a popular Web3 protocol. This domain is currently offline, but its malicious intent was confirmed before takedown. It was registered through NameCheap, Inc. on January 14, 2026, and resolves to IP address 162.213.255.48. The page title displayed was "Wall Net Sync," a likely attempt to mimic WalletConnect's branding. PhishDestroy's analysis shows the domain appears on 4 security blocklists and lacks an SSL certificate, further indicating its fraudulent nature.

According to VirusTotal, 15 out of 95 security vendors flagged this domain as malicious, underscoring its risk. The domain's creation date is notably recent, and its registration through a privacy-focused registrar like NameCheap is common among phishing operations. The IP address 162.213.255.48 may host other suspicious domains, though this was not confirmed. The combination of brand impersonation, lack of encryption, and blocklist presence elevates the risk level to high.

Since the domain is now offline, the immediate threat to users is reduced. However, PhishDestroy recommends that anyone who may have interacted with this site—especially by connecting a crypto wallet or entering credentials—should take immediate action. This includes revoking any permissions granted to the site, changing passwords for related accounts, and monitoring for unauthorized transactions. Users should always verify website URLs carefully, especially when dealing with sensitive services like WalletConnect, and avoid clicking on unsolicited links. Staying informed through security tools and blocklists can help prevent future encounters with such threats.