conneeectwallet[.]gitbook[.]io

This domain, conneeectwallet[.]gitbook[.]io, is actively impersonating the WalletConnect brand. The site was registered on March 30, 2014 through Cloudflare, Inc., and resolves to the IP address 172.64.147.209, which belongs to AS13335 Cloudflare, Inc. in the United States. The TLS certificate is issued by Google Trust Services under the WE1 identifier, indicating a valid HTTPS endpoint, while the underlying infrastructure is provided by Cloudflare and supports HTTP/3. An HTTP 307 response is observed, suggesting a redirection behavior that may be used to forward victims to a malicious landing page. The page title returned by the server reads “Connect Wallet - Wallet%Connect | Wallet Connect | us”, reinforcing the brand‑impersonation intent.

Google Safe Browsing classifies the URL as a social engineering threat, and the domain appears on at least one public blocklist, where it is listed by PhishDestroy. VirusTotal analysis shows that 15 of 95 scanning engines flag the domain, reflecting a moderate consensus of malicious intent. Additional reputation data includes a Gridinsoft trust score of 0 out of 100, indicating a lack of trust. Nameserver records point to dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com, confirming Cloudflare’s role as the authoritative DNS provider. The combination of brand‑specific page title, redirection status, low trust scores, and multiple vendor detections suggests a high‑risk crypto‑related impersonation campaign targeting WalletConnect users.

However, the exact payload, credential‑harvesting mechanisms, or victim interaction flow have not been publicly disclosed, leaving the precise attack vector uncertain. Defenders should immediately block conneeectwallet[.]gitbook[.]io at the DNS and proxy layers, add the domain to web‑filtering and endpoint protection blocklists, and monitor for outbound connections to the associated Cloudflare IP range.