wallet-connect-web[.]app

This domain, wallet-connect-web.app, is identified as a high-risk brand impersonation threat targeting WalletConnect, a widely used protocol for connecting cryptocurrency wallets to decentralized applications. The site is designed to deceive users into believing they are interacting with a legitimate WalletConnect interface, potentially leading to unauthorized access to wallet credentials, private keys, or direct cryptocurrency theft. Such impersonation attacks are commonly used to trick users into signing malicious transactions or revealing sensitive information under false pretenses, often resulting in financial loss or complete account compromise. Analysis indicates that wallet-connect-web.app was registered on February 21, 2026, through Hosting Concepts B.V. d/b/a Registrar.eu, a registrar frequently associated with suspicious domains. The domain resolves to the IP address 190.97.166.172, hosted under AS27956 (Cyber Cast International, S.A.) in Panama, a region often leveraged for anonymized or malicious hosting. At the time of assessment, 21 out of 95 security vendors on VirusTotal flagged the domain as malicious, and it appears on five security blocklists, including those maintained by crypto-specific threat intelligence sources. The absence of an SSL certificate further undermines its legitimacy, as modern secure connections are a baseline expectation for financial or crypto-related services. Users who visited wallet-connect-web.app should assume their interactions were monitored or manipulated. Immediately revoke any wallet permissions granted during the visit using a trusted interface, such as the official WalletConnect website or a verified decentralized application. Scan the device used to access the site for malware, as brand impersonation pages often deploy additional payloads. Monitor connected wallets for unauthorized transactions and consider transferring assets to a new wallet if suspicious activity is detected. Report the domain to relevant threat intelligence platforms to aid in broader detection and takedown efforts. Always verify domain authenticity by cross-referencing with official sources before entering credentials or signing transactions.