snipe[.]snipestools[.]com

This domain, snipe.snipestools.com, poses a direct threat to cryptocurrency users by impersonating WalletConnect, a legitimate wallet connection service. The site is designed to trick visitors into linking their crypto wallets, enabling attackers to drain funds once access is granted. The page title, 'Connect Wallet,' reinforces the deception by mimicking the authentic WalletConnect interface, increasing the likelihood of user interaction under false pretenses. Analysis indicates the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar often exploited for malicious infrastructure. The domain resolves to 172.67.192.162, hosted on Cloudflare’s network (AS13335), which is frequently used to obscure the true origin of phishing sites. Security vendors on VirusTotal flagged the domain as malicious, with 9 out of 95 engines detecting it. Additionally, the domain appears on one security blocklist, further confirming its association with fraudulent activity. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as attackers commonly use valid certificates to lend credibility to phishing sites. Users who visited snipe.snipestools.com should assume their wallet credentials or connected sessions may have been compromised. Immediately disconnect any wallets linked to the site and revoke access via the official WalletConnect interface or the wallet’s connected apps list. Monitor all connected accounts for unauthorized transactions and enable transaction alerts if available. If funds were transferred, report the incident to the relevant blockchain explorer and local cybercrime authorities. Avoid interacting with any domains associated with the registrar NiceNIC International Group Co., Limited, or resolving to Cloudflare IPs without prior verification, as these may indicate ongoing malicious campaigns.