org-wlletconnect-connect[.]webflow[.]io

This domain is flagged as a high-risk crypto drainer phishing site impersonating WalletConnect, a widely used protocol for connecting decentralized applications to cryptocurrency wallets. The infrastructure is designed to deceive users into connecting their wallets, enabling unauthorized transactions and asset theft. Analysis indicates the threat is actively targeting individuals in the cryptocurrency ecosystem, with a focus on draining funds from compromised wallets. Infrastructure analysis reveals the domain org-wlletconnect-connect.webflow.io resolves to IP address 104.18.36.248, a shared hosting environment. VirusTotal detection rates show 8 out of 95 security vendors have flagged this domain as malicious, with classifications including phishing and brand impersonation. The page title, 'WalletConnect | Home | Wallet Connect,' closely mimics the legitimate WalletConnect site, increasing the likelihood of successful deception. The SSL certificate is issued by Google Trust Services, providing a false sense of security to potential victims. No creation date or registrar details are publicly available due to the domain being hosted on Webflow's subdomain infrastructure, which limits visibility into its origin. Mitigation steps for this threat type include immediate blocking of the domain and associated IP address (104.18.36.248) at the network perimeter. Organizations and individuals should deploy browser-based protections to prevent access to the domain and monitor for wallet connection requests originating from untrusted sources. Users should be educated to verify the authenticity of WalletConnect-related domains by cross-referencing with the official website and checking for subtle misspellings or irregularities. Wallet providers are advised to implement transaction confirmation prompts that explicitly warn users when interacting with high-risk domains or applications.