cfxzy-gaaaa-aaaah-qpvtq-cai[.]icp0[.]io

This domain, cfxzy-gaaaa-aaaah-qpvtq-cai.icp0.io, has been identified as a brand_impersonation threat targeting WalletConnect, a protocol for connecting decentralized applications to cryptocurrency wallets. The domain is currently offline, though its prior activity suggests malicious intent to deceive users into disclosing sensitive credentials or interacting with fraudulent blockchain transactions. Analysis of the domain reveals it was flagged by 1 of 95 security vendors on VirusTotal, indicating limited but confirmed detection. The domain was registered on September 6, 2022, through GoDaddy.com, LLC, and resolves to the IP address 162.247.129.233. It appears on a single security blocklist, and its Gridinsoft trust score is 0 out of 100, reflecting high suspicion. The page title, 'React App,' and detected technologies, including React and HSTS, suggest a frontend framework commonly used in phishing kits. The SSL certificate is issued by Let's Encrypt, a legitimate provider, which does not mitigate the domain's malicious nature. The domain has since been taken offline, reducing immediate risk to users. However, organizations and individuals should remain vigilant. Network administrators are advised to block the domain and its associated IP (162.247.129.233) at the perimeter. End users should verify the authenticity of any WalletConnect-related communications or interfaces, particularly those prompting wallet connections or transaction approvals. Monitoring for similar domains registered through the same registrar or resolving to the same IP may help identify related threats. If prior interaction with this domain is suspected, affected parties should revoke active sessions, rotate credentials, and review transaction histories for unauthorized activity.