mantle-network-bridge[.]top

mantle-network-bridge.top is a newly registered domain (created 21 Feb 2026) that presents a page titled “Mantle Bridge – Bridge Your Hyperscaling Rocket Fuel”. The title and the declared impersonation of the Ethereum brand indicate a wallet/seed phishing campaign targeting users seeking to interact with the Mantle bridge service. The domain resolves to 104.21.64.1, an address owned by Cloudflare (AS13335) located in the United States. DNS resolution is served by dns17.parkpage.foundationapi.com and dns18.parkpage.foundationapi.com, both under the parkpage.foundationapi.com infrastructure. Registration was performed through PDR Ltd. The site currently returns HTTP 200, and its SSL certificate is listed as “WE1”.

Threat intelligence feeds have placed the domain on two security blocklists, and it is actively blocked by PhishDestroy and ScamSniffer. On VirusTotal, five of ninety‑three scanners generated a detection, confirming malicious intent. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the classification as a malicious resource. The combination of a brand‑specific page title, wallet/seed phishing label, and low trust scores aligns with known patterns used to harvest private keys or seed phrases from cryptocurrency users. The operational status is reported as offline, suggesting the phishing site may have been taken down or is being rotated.

No additional content beyond the page title has been published, limiting the ability to analyse page structure, form fields, or redirection behavior. Nonetheless, the presence on multiple blocklists, the low trust rating, and the detection by several antivirus engines provide sufficient evidence for a high confidence malicious assessment. Defenders should add mantle-network-bridge.top to DNS and web‑proxy blocklists, monitor for future re‑registration attempts, and consider network‑level alerts on connections to 104.21.64.1 that originate from users accessing Ethereum‑related services.