ngrok[.]pro

This domain is flagged as an elevated-risk cryptocurrency wallet phishing endpoint. Analysis indicates it was designed to impersonate legitimate tunneling infrastructure, specifically targeting users of decentralized applications or wallet services. The subdomain ao.signal.ngrok.pro, referenced in the page title ERR_NGROK_3200, suggests an attempt to mimic trusted communication or signaling protocols, a common tactic in credential harvesting campaigns. Infrastructure analysis reveals the domain was registered through Gandi SAS on February 21, 2026, and resolves to the IPv6 address 2a05:d014:21b:8e01:ebba:e868:ffe7:8a42, hosted on Amazon.com, Inc. infrastructure (AS16509) in Germany. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, and is flagged by 8 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Let's Encrypt (serial number E7), which, while standard for legitimate sites, is frequently exploited in phishing campaigns due to its low barrier to acquisition. The domain's current offline status (ERR_NGROK_3200) may indicate takedown or evasion efforts by the threat actor. Mitigation for this specific threat type involves several technical and procedural steps. Users should verify domain authenticity by cross-referencing with official service documentation, particularly for tunneling or wallet-related endpoints. Network-level protections should block the domain and its resolved IP address (2a05:d014:21b:8e01:ebba:e868:ffe7:8a42) at firewalls and DNS resolvers. Organizations should monitor for connections to this IP or domain in logs, as it may indicate compromised endpoints. Additionally, users who interacted with this domain should rotate credentials for any associated accounts, particularly cryptocurrency wallets, and enable multi-factor authentication where available. Security teams are advised to treat this domain as a high-confidence indicator of compromise (IOC) in threat hunting activities.