# PhishDestroy domain threat record: bifrostwallethub.web.app Content language: English Canonical HTML report: https://phishdestroy.io/domain/bifrostwallethub.web.app/ Machine-readable companion: https://phishdestroy.io/domain/bifrostwallethub.web.app/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-15 16:40:09 UTC - Last availability or vendor check: 2026-10-22 10:05:58 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 10/89 - Independent public blocklist matches in the stored snapshot: 1 - Matching public blocklists: ScamSniffer - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 199.36.158.100 - Registrar in stored WHOIS data: MarkMonitor Inc. - Last stored HTTP status: 301 - Registration date (registry RDAP, web.app): 2019-01-08 22:05:04 UTC ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/bifrostwallethub.web.app - Certificate Transparency search: https://crt.sh/?q=%25.bifrostwallethub.web.app - Web Archive lookup: https://web.archive.org/web/*/https://bifrostwallethub.web.app/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview bifrostwallethub.web.app is a domain on the PhishDestroy blocklist whose name borrows the Bifrost Wallet brand and adds a generic "hub" suffix. That pattern is common in addresses aimed at crypto wallet users. PhishDestroy first saw it on 2026-09-15. When last checked on 2026-10-19, the address was still alive and redirecting visitors elsewhere. How the scam works The page currently shows the title "Site Not Found", while PhishDestroy lists the domain as suspicious. The main risk comes from the name. Wallet-themed addresses that pose as support or connection hubs are typically used to get visitors to type in a recovery phrase or approve a wallet connection. Either one can hand an attacker control of the funds. Because the address redirects, what a visitor actually lands on depends on where it points at that moment. Evidence Ten of 89 VirusTotal engines flagged the domain in the check on 2026-09-23. Named vendors include alphaMountain.ai, BitDefender, ESET, Emsisoft, Forcepoint ThreatSeeker, Fortinet, G-Data and Gridinsoft. That is a minority of engines, but the vendors are independent of each other and agree. ScamSniffer, a blocklist focused on crypto threats, also lists it alongside PhishDestroy. That matches the wallet theme in the name. Infrastructure The site sits on a web.app subdomain, Google's Firebase Hosting platform. Anyone can publish there quickly and for free. The address resolves to 199.36.158.100 on a Fastly, Inc. network in the US. Its Google Trust Services (WR4) certificate is the platform's standard one, so the padlock says nothing about who runs the page. What to do Do not enter a recovery phrase or private key on this site or any page it redirects to. Bifrost Wallet users should reach the wallet only through its official app or a bookmarked address. If you typed in your phrase, assume it is compromised and move your funds to a newly created wallet right away. If you connected a wallet, review and revoke any token approvals you do not recognize. Defenders should block the domain and its redirect targets, and watch for similar Bifrost-themed lookalikes. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/bifrostwallethub.web.app Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=bifrostwallethub.web.app Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:47:30 UTC ## Stored page captures - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/cc4f3b3b-3c8f-45dd-8412-70115eafd448.png Captured: 2026-09-23 02:52:15 UTC Source report: https://radar.cloudflare.com/scan/cc4f3b3b-3c8f-45dd-8412-70115eafd448 SHA-256: d21bbb4622efb000a1bfaed4a4ac90b97ecb5b20f09e085c4115077feab48668 - URLScan ยท 2026-08-27: https://screenshots.phishdestroy.io/us/01a04253-aa38-712d-9a7b-1edd207664dc.png Captured: 2026-08-27 08:26:20 UTC Source report: https://urlscan.io/result/01a04253-aa38-712d-9a7b-1edd207664dc/ SHA-256: f6f98f497224ba2f1876a8ef5f9a9f06be35c4e08b9ad12cb3b672a292046d2c ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-20T22:30:09Z", "uuid": "cc4f3b3b-3c8f-45dd-8412-70115eafd448", "scanned_at": "2026-09-23T02:52:15Z", "final_url": "https://bifrostwallethub.web.app/", "status": 404, "history": [ { "url": "https://bifrostwallethub.web.app/", "status": 404 } ], "dom_hash": "36af51d63eb1a24eee76f2933679adf6a1030ae3a4cc310a0a17e05739a719c9", "doc_hash": "dd7c22b3f25d3c331abc00a714b9672396f01a14648bd3ed99f45ceeb64a2642", "url_risks": [ "Phishing" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "bifrostwallethub.web.app", "type": "A", "value": "199.36.158.100" }, { "name": "bifrostwallethub.web.app", "type": "AAAA", "value": "2620:0:890::100" } ], "dnssec_valid": false, "ip": "199.36.158.100", "verdict": { "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] }, "whois": { "registrar": "MarkMonitor Inc.", "created": "2019-01-08T22:05:04Z", "updated": "2025-12-12T10:38:29Z", "expires": "2027-01-08T22:05:04Z", "nameservers": [ "ns1.googledomains.com", "ns2.googledomains.com", "ns3.googledomains.com", "ns4.googledomains.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T00:31:08Z", "analysis_at": "2026-09-22T10:06:47Z", "stats": { "timeout": 0, "harmless": 45, "malicious": 12, "suspicious": 2, "undetected": 33 }, "detections": { "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "Webroot": "malicious", "Emsisoft": "phishing", "Fortinet": "phishing", "Netcraft": "malicious", "LevelBlue": "phishing", "Gridinsoft": "suspicious", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "alphaMountain.ai": "Hosting, Phishing (alphaMountain.ai)" }, "registrar": "MarkMonitor Inc.", "created": "2019-01-08T22:05:04Z", "expires": "2026-01-08T22:05:04Z", "updated": "2024-12-12T10:14:49Z", "first_seen": "2026-08-21T21:23:10Z", "dns": [ { "ttl": 21600, "type": "A", "value": "199.36.158.100" }, { "ttl": 21600, "type": "AAAA", "value": "2620:0:890::100" } ], "dns_at": "2026-09-23T05:37:16Z", "jarm": "29d3fd00029d29d00041d41d00041d6b5eefa2404a56c2ced79a0d16afe36c", "cert": { "san": [ "web.app", "*.web.app" ], "issuer": "Google Trust Services / WR4", "serial": "93ab2a7aed4acb210af6c0fb093163bc", "sha256": "d69d48c3edf1af146f82e0e40950ba1d2c2a6ac9875657536c51cd7e9b82591b", "subject": "web.app", "valid_to": "2026-10-18T14:59:54Z", "valid_from": "2026-07-20T14:59:55Z" }, "whois": { "registrar": "MarkMonitor Inc.", "registrar_iana_id": "292", "registrar_url": "http://www.markmonitor.com", "created": "2019-01-08T22:05:04Z", "updated": "2024-12-12T10:14:49Z", "expires": "2026-01-08T22:05:04Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited", "clientUpdateProhibited" ], "nameservers": [ "ns1.googledomains.com", "ns2.googledomains.com", "ns3.googledomains.com", "ns4.googledomains.com" ], "dnssec": "unsigned" } } } ```