app-benqi[.]fi

Analysis of app-benqi.fi, observed on July 24, 2026, indicates a confirmed wallet/seed phishing operation that impersonates multiple brands. The domain was registered on February 21, 2026 and currently resolves to the IP address 37.27.135.61, hosted in Finland under AS24940 Hetzner Online GmbH. The site’s HTTP response is no longer reachable, as the domain is listed as offline, but historical data shows it was blocked by the PhishDestroy and ScamSniffer blocklists and appears on two additional security blocklists.

The TLS certificate presented was identified as version R11, suggesting a short‑lived or self‑signed certificate typical of malicious deployments. The page title returned during the brief availability window was "Benqi," aligning with the reported scam type of wallet/seed phishing and the broader brand‑impersonation label. VirusTotal analysis recorded a single positive detection out of 93 scanning engines, reinforcing the suspicion of malicious intent despite the low detection count.

The evidence base does not include any observed content beyond the page title, nor any confirmed phishing page structure, leaving the exact visual tactics uncertain. Defenders should continue to block the domain and its associated IP, incorporate the domain into internal deny lists, and monitor for any re‑registration or alternative hosting that might resurrect the campaign. Users should be warned against entering seed phrases or wallet credentials on sites claiming to be associated with Benqi or related brands, and any unsolicited communications referencing the domain should be treated as potentially malicious.