bifrostwallet[.]pages[.]dev

PhishDestroy identifies bifrostwallet.pages.dev as an active crypto drainer domain designed to siphon cryptocurrency assets from unwary users. This threat leverages deceptive branding to trick victims into connecting wallets or entering seed phrases, resulting in irreversible fund transfers. The domain mimics legitimate crypto wallet services, specifically targeting users through social engineering tactics such as fake airdrops or urgent transaction alerts. Given the high-risk classification and active status, all users should treat this domain as hostile and immediately block all associated indicators. This domain exhibits multiple red flags across security platforms. VirusTotal confirms detection by 17 out of 95 security vendors, while Google Safe Browsing classifies it under SOCIAL_ENGINEERING. The domain is registered via Cloudflare, Inc. and resolves to IP 172.66.44.95, which is associated with malicious hosting infrastructure. Additionally, the domain appears on 1 security blocklist and is flagged by MetaMask. The SSL certificate, issued by Google Trust Services, adds a false sense of legitimacy, though it does not mitigate the underlying malicious intent. These combined factors elevate the risk profile significantly, warranting immediate defensive action. Mitigation against crypto drainers like bifrostwallet.pages.dev requires a multi-layered approach. Users must avoid interacting with the domain entirely, including clicking links or downloading files. Organizations should block the domain and IP (172.66.44.95) at the network perimeter and update endpoint protections to detect wallet-draining behaviors. Security teams should also monitor for connections to this domain in proxy logs or DNS queries. For individuals, enabling wallet protection features (e.g., transaction simulation) and never entering seed phrases on untrusted sites are critical steps. Immediate reporting to wallet providers (e.g., MetaMask) and security teams can help disrupt further campaigns.