bifrost-bfc-code[.]trackfinanceworld[.]com

On 24 July 2026 analysts observed the domain bifrost-bfc-code.trackfinanceworld.com, which is currently taken offline. The domain was created on 30 January 2025 and is registered through MainReg INC. DNS resolution points to the IP address 104.26.9.162, which belongs to AS13335 Cloudflare, Inc., locating the host in the United States. The authoritative nameservers are conrad.ns.cloudflare.com and fish.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and CDN services. The site served an HTTPS certificate issued by Google Trust Services under the “WE1” label, confirming a valid TLS chain.

An HTTP request to the site returned a 403 status code, suggesting that access to the page is currently denied. The page title reported by the crawler is “Bifrost (BFC) Code ™ – The Official App WebSite 2025 [UPDATED]”. No additional content has been captured, and the site’s technology fingerprint includes Cloudflare Browser Insights, the Cloudflare platform itself, and support for HTTP/3. The domain appears on a single security blocklist, specifically PhishDestroy, and is listed in the VirusTotal dataset where eight of ninety‑five scanning engines flagged the domain as malicious. No other public blocklists or safe‑browsing services are noted.

Evidence points to a credential‑harvesting operation, although the exact phishing kit or lure has not been disclosed. Defenders should continue to block the domain at network perimeter devices, update URL filtering rules to include the observed IP range and the Cloudflare nameservers, and monitor for any re‑registration attempts. Threat‑intelligence feeds should be refreshed to capture any future activity, and endpoint security solutions should be configured to alert on connections to the associated IP address. Because the site is currently offline, real‑time observation is limited; further investigation is required if the domain becomes active again.