walletconnects-wnt[.]hf[.]space

This domain, walletconnects-wnt.hf.space, is flagged as a high-risk crypto drainer targeting users of the WalletConnect protocol. Analysis indicates it employs the Wallet Connect Abuse drainer kit, designed to siphon cryptocurrency assets by tricking victims into authorizing malicious transactions under the guise of legitimate wallet connectivity. The domain impersonates WalletConnect, a widely used service for connecting decentralized applications to crypto wallets, increasing the likelihood of successful exploitation due to brand recognition. Technical indicators confirm the domain's malicious nature. It resolves to the IP address 44.219.8.222 and was registered through OVH, SAS on November 01, 2021. VirusTotal reports 2 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Amazon, and the page title, Universal Wallet Connect, further reinforces the impersonation of the legitimate WalletConnect service. Infrastructure analysis reveals the domain was created prior to the recent surge in crypto drainer campaigns, suggesting potential long-term abuse or repurposing of older infrastructure. As of the latest assessment, walletconnects-wnt.hf.space has been taken offline, likely due to detection and mitigation efforts such as inclusion in blocklists or hosting provider intervention. However, residual risk persists due to the potential reuse of the drainer kit or infrastructure by threat actors. Users who interacted with the domain should revoke any suspicious wallet authorizations and monitor connected accounts for unauthorized transactions. Organizations are advised to update blocklists with the domain and associated IP to prevent future access attempts. Continuous monitoring of similar domains impersonating WalletConnect or other crypto services is recommended to mitigate evolving threats.