appbifrost[.]com

This domain, appbifrost.com, is flagged as a high-risk crypto drainer phishing site designed to illicitly extract cryptocurrency from victims. Analysis indicates the domain impersonates a legitimate service under the guise of "Bifrost: Direct, Instant and Genuine," a common tactic to deceive users into connecting wallets or entering sensitive credentials. The threat type aligns with known crypto drainer schemes, which automatically siphon funds upon interaction, often leaving victims with irreversible losses. Infrastructure analysis reveals multiple critical indicators of compromise. The domain is detected by 17 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly flagging it as phishing. It appears on one security blocklist and is currently blocked by PhishDestroy. The domain was registered on January 20, 2025, through GoDaddy.com, LLC, and resolves to the IP address 76.76.21.21, hosted on Amazon.com, Inc. infrastructure (AS16509). Notably, the site lacks an SSL certificate, a red flag for any domain handling sensitive transactions. The page title and branding further suggest an attempt to mimic legitimate cryptocurrency services, increasing the likelihood of successful social engineering. Mitigation steps for this threat type require immediate action from both end-users and network administrators. Users who interacted with appbifrost.com should assume wallet compromise and take the following steps: revoke all connected dApp permissions, transfer remaining funds to a new wallet, and monitor transaction histories for unauthorized activity. Network administrators should block the domain and its resolving IP (76.76.21.21) at the firewall or DNS level to prevent access. Organizations should also update security policies to include this domain in phishing awareness training, emphasizing the risks of crypto drainers. Given the domain’s recent creation and lack of SSL, additional scrutiny should be applied to similarly structured domains registered through the same registrar or hosted on shared infrastructure.