app[.]bitcoinprogwallet[.]com

Analysis of the domain app.bitcoinprogwallet.com, registered through Cloudflare, Inc., indicates active brand impersonation targeting Bitcoin. As of July 19, 2026, the domain resolves to IP address 45.79.13.185 (Linode, US) and presents an HTTP 200 status, suggesting the page remains operational. The page title is explicitly labeled 'BitcoinProg Wallet,' reinforcing the impersonation of a cryptocurrency wallet service. Infrastructure analysis reveals nameservers dax.ns.cloudflare.com and gabriella.ns.cloudflare.com, consistent with Cloudflare-hosted domains. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites. Security vendor detections are limited, with 2 of 91 engines on VirusTotal flagging the domain. The domain appears on one security blocklist, specifically PhishDestroy. No additional details regarding the scam mechanics (e.g., credential harvesting, crypto drainer functionality) or specific user interactions are available at this time. Defenders should treat this domain as high-risk due to its confirmed brand impersonation and active status. Recommended actions include blocking the domain and IP at network perimeters, alerting users to avoid interaction, and monitoring for connections to 45.79.13.185 or related subdomains. Further investigation into the site's backend infrastructure and potential affiliate campaigns is advised.