criteria[.]wct-token[.]live

This domain, criteria.wct-token.live, was taken offline as of the report date but retains a high‑risk profile due to multiple indicators of a credential‑stealing campaign targeting Coinbase users. The site resolved to the IP address 188.114.96.3, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. No TLS certificate was presented, indicating the site operated over plain HTTP. The page title observed during the brief capture phase was “Unlock Web3 Potential with Walletconnect Airdrop WC Today!”, matching the known “Airdrop Scam” phishing kit and confirming a crypto‑focused social‑engineering lure.

Google Safe Browsing classified the URL as a social‑engineering threat, and fifteen of ninety‑three VirusTotal scanners flagged the domain as malicious, reinforcing the suspicion of malicious intent. The domain was registered on 21 February 2026 through PublicDomainRegistry.com (PDR Ltd.) and uses Cloudflare name servers (andronicus.ns.cloudflare.com, kinsley.ns.cloudflare.com). It appears on a single external blocklist and has been actively blocked by the PhishDestroy service. The evidence confirms that the infrastructure is typical of fast‑flux or low‑cost phishing operations: a recent registration, shared Cloudflare hosting, and a lack of SSL.

However, the limited visibility of additional supporting artifacts leaves the full scope of the campaign uncertain. Defenders should add the domain and its hosting IP to URL filtering and DNS block policies, monitor for newly registered subdomains under the same registrar, and enforce TLS‑only connections for any legitimate Coinbase interactions. Continuous threat‑intel feeds should be consulted for any resurgence of the domain or related Airdrop‑kit activity.