domanconn[.]vercel[.]app

Analysis of domanconn.vercel.app indicates a deliberate attempt to impersonate the WalletConnect brand. The domain resolves to IP address 64.29.17.67, which belongs to Amazon.com, Inc. (AS16509) and is hosted in the United States. Registration data show the domain was created on February 21, 2026 through Tucows Domains Inc., suggesting a recent acquisition coincident with the observed malicious activity. The site presents a page title of "Wallet Connect | Loading," matching the targeted brand, and the underlying hosting platform is identified as Vercel with HTTP Strict Transport Security (HSTS) enforced.

An SSL certificate issued by Google Trust Services under the WR1 designation secures the connection, providing a veneer of legitimacy. HTTP response for the current endpoint returns a 404 status, and the domain is presently taken offline, consistent with the "under investigation" risk level. VirusTotal records reveal the domain was scanned by 93 vendor engines without any detections, which does not constitute evidence of safety given the lack of malicious payloads at the time of scan. The domain appears on three independent security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the classification as a crypto‑related scam.

While the exact content of the page has not been captured, the convergence of brand‑specific title, recent registration, hosting on a reputable cloud provider, and inclusion on multiple anti‑phishing lists provides concrete indicators of an impersonation campaign targeting WalletConnect users. Defenders should continue to monitor the domain for any re‑activation, enforce DNS‑level blocking within corporate networks, and add the domain to internal threat‑intel feeds. Additional scrutiny of related subdomains and newly registered domains using similar naming patterns is recommended to pre‑empt further brand‑spoofing attempts.