bitfrost[.]live

bitfrost.live has been confirmed as an active generic phishing site. This domain poses a high risk by masquerading as a cryptocurrency wallet to harvest user credentials and private keys. The campaign is currently undetected by security vendors, with 0 detections on VirusTotal as of the latest scan, and has not yet been added to public blocklists. Given the domain’s recent creation on February 20, 2026, and the use of a Let’s Encrypt SSL certificate, attackers are leveraging trusted infrastructure to lend credibility to their fraudulent site. The infrastructure is hosted at IP 187.77.176.43, which has no established reputation, and is registered through NameSilo, LLC, a registrar commonly abused for short-lived malicious domains. The combination of low detection rates, new registration, and plausible infrastructure suggests this is an early-stage operation likely targeting cryptocurrency users under the guise of wallet services or seed phrase recovery tools. This domain exhibits several red flags consistent with credential harvesting campaigns. It was registered on February 20, 2026, indicating a very recent deployment, which is common in fast-moving phishing operations. VirusTotal currently shows 0 detections out of 95 engines, signaling that signature-based defenses have not yet caught up to this threat. The domain resolves to IP 187.77.176.43, an address with no prior association in threat intelligence databases, further complicating detection. The use of a Let’s Encrypt SSL certificate adds a veneer of legitimacy, making it more likely for victims to enter sensitive data. The registrar, NameSilo, LLC, has been frequently observed in abuse reports tied to spam, phishing, and malware distribution, though registration alone is not inherently malicious. There are no current entries on public blocklists such as Google Safe Browsing, PhishTank, or OpenPhish, suggesting a gap in proactive threat blocking. To mitigate exposure to this threat, users should immediately block access to bitfrost.live at the network level and avoid visiting the domain. If credentials or private keys have been entered, users must revoke all associated wallet access, transfer remaining funds to a new wallet, and enable two-factor authentication on all related accounts. Organizations should add the domain and IP (187.77.176.43) to internal blocklists and monitor for outbound connections to these indicators. Security teams should also inspect DNS logs for queries to bitfrost.live and scan endpoints for signs of credential theft or wallet-related malware. Given the domain’s low detection status, updating threat intelligence feeds with this IOC and reporting it to CERTs and domain registrars can help accelerate remediation. Proactive threat hunting for similar domains with recent creation dates and low trust scores is recommended to prevent further spread of this campaign.