debridge[.]foundations[.]name

This domain, debridge.foundations.name, is flagged as a high-risk cryptocurrency phishing site targeting the deBridge brand. Registered on November 19, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, the domain remains active as of July 12, 2026, despite being blocked by one security vendor, PhishDestroy. Analysis indicates the domain resolves to IP address 188.114.97.3, hosted on Cloudflare’s infrastructure (AS13335) in the United States. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and malicious domains leveraging Cloudflare’s services. Infrastructure analysis reveals the domain employs Cloudflare’s nameservers (meilani.ns.cloudflare.com and zahir.ns.cloudflare.com) and technologies such as Cloudflare Browser Insights and HTTP/3. The page title, 'Nur einen Moment…,' suggests a temporary holding or redirect page, though the exact content and functionality remain unconfirmed due to an HTTP 403 status. VirusTotal reports 3 out of 95 security vendors flagging the domain as malicious, a relatively low detection rate that may indicate either early-stage evasion or limited visibility in threat intelligence feeds. The domain’s registration and hosting patterns align with known cryptocurrency phishing campaigns, particularly those impersonating cross-chain bridging platforms. While the specific scam mechanics are not yet analyzed, the combination of brand impersonation, Cloudflare hosting, and a recently registered domain raises concerns. Defenders should treat this domain as actively malicious and prioritize blocking access at the network level, particularly in environments where cryptocurrency transactions or deBridge-related activities occur. Monitoring for related domains using similar naming conventions (e.g., foundations.name) may help identify additional threats in this campaign.