rpcdexesconnection[.]xyz

This domain, rpcdexesconnection.xyz, is identified as a phishing resource specializing in brand impersonation targeting WalletConnect, a protocol for connecting decentralized applications to cryptocurrency wallets. The threat type is classified as credential harvesting and session hijacking, with the intent to deceive users into disclosing wallet credentials or authorizing malicious transactions. As of the latest assessment, the domain has been taken offline, though prior activity remains under investigation. Analysis indicates the domain was registered through Global Domain Group LLC on November 12, 2025, and resolved to the IP address 104.21.56.63, hosted on infrastructure operated by Cloudflare, Inc. (AS13335). The domain appears on two security blocklists and is flagged by 18 of 95 vendors on VirusTotal, reflecting broad detection across multiple threat intelligence platforms. Notably, the domain lacked an SSL certificate, increasing the likelihood of interception or manipulation of user data in transit. The page title explicitly mimicked WalletConnect’s branding, further corroborating its fraudulent intent. Current infrastructure analysis reveals the domain is no longer active, though residual risks may persist through cached or archived copies. Organizations and users are advised to block the domain and associated IP at the network level, monitor for related indicators of compromise, and verify all WalletConnect interactions through official channels. Cryptocurrency wallet providers should alert users to this campaign and reinforce multi-factor authentication for sensitive operations.