walletconnect[.]blanq[.]app

Analysis of walletconnect.blanq.app confirms active brand impersonation targeting WalletConnect, a cryptocurrency wallet connection service. The domain, registered through Namecheap Inc., resolves to 66.33.60.193 (US, AS16509 Amazon.com, Inc.) and is hosted behind Cloudflare nameservers aspen.ns.cloudflare.com and ned.ns.cloudflare.com. The site returns HTTP status 526, indicating an invalid SSL certificate configuration, though the certificate itself is issued by Google Trust Services (WE1). Detected technologies include Vercel, HSTS, and HTTP/3, suggesting a modern hosting stack commonly abused for phishing infrastructure. The domain appears on one security blocklist and is flagged by 2 of 95 security vendors on VirusTotal as malicious. The page title 'Blanq App' does not match the legitimate WalletConnect branding, reinforcing the impersonation attempt. The scam type is explicitly classified as a crypto scam, aligning with the targeted brand's ecosystem. No additional payloads or redirect chains have been confirmed at this time, but the domain remains active as of July 12, 2026. Defenders should prioritize blocking this domain at DNS and network levels, particularly in environments handling cryptocurrency transactions. The use of Cloudflare and Vercel infrastructure may complicate takedown efforts, but reporting to the registrar (Namecheap) and hosting provider (Amazon) is recommended. Further analysis of the site's content or backend scripts is pending, though the current indicators are sufficient for high-confidence classification as malicious.