wallet-connect-six-sigma[.]vercel[.]app

This domain, wallet-connect-six-sigma.vercel.app, was observed delivering a brand‑impersonation campaign targeting the WalletConnect service. The site returned HTTP status code 451, indicating legal removal, and the page title presented was “Deployment Unavailable”. Technical fingerprinting identified the Vercel hosting platform with HTTP Strict Transport Security enabled, and the TLS certificate was issued by Google Trust Services under the WR1 label. DNS resolution points to IP 216.198.79.67, which belongs to Amazon.com, Inc. (AS16509) and is geolocated to the United States.

The domain registration occurred on 21 February 2026 through Tucows Domains Inc., and the domain has since been taken offline. Independent threat‑intel providers have listed the domain on four security blocklists, and it is currently blocked by the PhishDestroy, Polkadot, Enkrypt, and Codeesura mitigation services. Google Safe Browsing has flagged the site for social‑engineering content, and VirusTotal recorded 12 detections out of 93 scanning engines. The combination of brand impersonation, a recent registration date, and the presence on multiple blocklists suggests a deliberate attempt to lure WalletConnect users into a crypto‑related scam.

At present, no additional payload or phishing page content has been captured, and the exact malicious workflow remains unverified. Defenders should continue to monitor the associated IP address and consider adding the domain to internal deny lists. Network traffic to the Vercel endpoint should be logged, and any user reports of unsolicited WalletConnect links should be investigated against this indicator. Because the infrastructure is already offline, remediation focuses on preventing re‑use of the same hosting resources and educating end‑users about unsolicited requests referencing WalletConnect.