bifrost83[.]com

Analysis of bifrost83.com indicates that the domain was registered on August 15, 2025 through NameSilo, LLC and is currently pointed to the Cloudflare‑owned address 172.67.132.180 (AS13335, United States). The domain resolves via the Cloudflare nameservers junade.ns.cloudflare.com and kinsley.ns.cloudflare.com, but no TLS certificate is presented, leaving the site without HTTPS protection. Threat intelligence flags the site as a brand‑impersonation campaign targeting Ethereum; the impersonation claim is corroborated by the explicit “Impersonates: Ethereum” tag in the intelligence feed. The domain has been added to at least one public security blocklist and was actively blocked by the PhishDestroy service.

VirusTotal analysis shows that 12 of 95 AV engines flagged the domain as malicious, providing independent vendor confirmation of suspicious activity. Reputation services assign extremely low trust scores (Scamadviser 1/100, Gridinsoft 0/100), reinforcing the assessment that the site is not trustworthy. The current operational status is listed as “offline”, indicating that the phishing infrastructure has been taken down or is no longer serving content. However, the underlying IP address remains under Cloudflare’s control and could be reused for future malicious campaigns.

No SSL certificate, page title, or HTTP response details are available, leaving the exact content of the site unverified. Defenders should therefore continue to block traffic to both the domain name and its resolving IP, monitor the associated Cloudflare nameservers for any re‑registration, and incorporate the domain into internal URL filtering and threat‑intel feeds. Additional scrutiny of any future domains registered by the same registrar or using the same nameservers is advised, as the threat actor may attempt to re‑establish a similar impersonation vector.