nodebridge[.]host

PhishDestroy identifies nodebridge.host as an active crypto-draining phishing domain currently under investigation for hosting fraudulent cryptocurrency wallet drainer pages. This malicious domain mimics legitimate crypto-bridge services to trick users into connecting crypto wallets under the guise of processing transactions. The campaign is designed to silently drain victim wallets of all tokens and NFTs without requiring explicit authentication once the wallet is linked.

This domain was flagged by zero out of ninety-five VirusTotal vendors as of the latest scan, indicating a currently undetected threat. nodebridge.host resolves to IP 188.114.97.3 and was registered through Dynadot Inc on December 19, 2025. The domain holds a valid SSL certificate issued by Google Trust Services, which may contribute to a false sense of legitimacy. Despite zero detections on VirusTotal, the lack of historical reputation and absence from mainstream blocklists such as Google Safe Browsing and OpenPhish suggests this domain is extremely recent and potentially part of a fast-moving, short-lived campaign targeting crypto users.

Given the domain’s active status and the significant risk it poses to cryptocurrency users, immediate defensive action is recommended. Users are advised to avoid interacting with nodebridge.host or any subdomains. Blocklists should be updated to include this domain and associated IP address (188.114.97.3) at the network perimeter and endpoint level. Additionally, cryptocurrency wallet users should be notified to verify any domain linking their wallet by cross-referencing with official sources via PhishDestroy or similar threat intelligence platforms. Continuous monitoring for related infrastructure is warranted due to the potential for rapid expansion through newly registered domains leveraging similar naming conventions.