wormhole-bridge[.]carrd[.]co

The domain wormhole-bridge.carrd.co is a phishing site engaged in brand impersonation targeting Wormhole, a cryptocurrency bridge service. This site was designed to deceive users into believing they were interacting with the legitimate Wormhole platform, posing an elevated risk of cryptocurrency theft. No drainer kit was identified, but the domain has since been taken offline.

Technical analysis shows that wormhole-bridge.carrd.co was flagged by 2 of 95 security vendors on VirusTotal, including ChainPatrol and alphaMountain.ai. The domain appears on 3 security blocklists: PhishDestroy, MetaMask, and SEAL. It was registered through MarkMonitor, Inc. on April 30, 2015, and resolves to the IP address 104.18.40.34, hosted by Cloudflare in the US. The SSL certificate is issued by Google Trust Services / WE1, and the nameservers are crystal.ns.cloudflare.com and henrik.ns.cloudflare.com. At the time of observation, the site returned a 404 error with the page title 'Page not found'.

Users who interacted with wormhole-bridge.carrd.co should immediately revoke any token approvals granted to unknown or suspicious contracts and transfer their funds to a new wallet. If credentials were entered, change passwords for all associated accounts and enable two-factor authentication. Report the phishing domain to the impersonated brand, Wormhole, and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in takedown efforts.