proposal-bifrostwallet[.]com

This domain is flagged as a crypto drainer, a type of malicious infrastructure designed to siphon cryptocurrency from victims by impersonating legitimate wallet services. The site mimics a self-custody, multi-chain wallet interface, tricking users into connecting their wallets or entering private keys, which are then exploited to drain funds without authorization. Analysis indicates the threat specifically targets decentralized finance (DeFi), non-fungible token (NFT), and Web3 users, leveraging social engineering to bypass security measures. Infrastructure analysis reveals the domain was registered on April 28, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, an uncommon creation date that may indicate an attempt to evade detection. It resolves to the IP address 104.21.84.195 and uses a Let’s Encrypt SSL certificate, providing a false sense of security. Despite being blocked by MetaMask, PhishDestroy, and SEAL, and appearing on three security blocklists, the domain has zero detections out of 95 engines on VirusTotal, highlighting limitations in automated detection for newly deployed threats. Technologies detected include React, Gatsby, Cloudflare, and Webpack, suggesting a sophisticated frontend designed to appear legitimate. If you visited proposal-bifrostwallet.com or interacted with its content, immediately disconnect any connected wallets and revoke permissions using a trusted blockchain explorer. Check all wallet addresses and transactions for unauthorized activity, particularly those involving DeFi, NFT, or cross-chain transfers. Rotate any exposed private keys or seed phrases, and monitor accounts for unusual outbound transactions. Given the domain’s offline status, remain vigilant for similar phishing attempts using lookalike domains or updated infrastructure. Report the domain to relevant security communities to aid in broader threat mitigation efforts.