retrobridge-portal[.]com

The domain retrobridge-portal.com was registered on June 17, 2025 through a registrar associated with Ultahost, Inc. It resolves to the Cloudflare‑owned address 172.67.174.217, and its authoritative nameservers are ainsley.ns.cloudflare.com and matt.ns.cloudflare.com. The site presents an HTTP 200 response and serves a TLS certificate issued by Google Trust Services, while Cloudflare’s edge provides HSTS, HTTP/3 and Browser Insights.

Content delivered by the host bears the title “openmediavault Workbench”, which does not correspond to any legitimate service associated with the domain name. This mismatch, combined with its classification as a cryptocurrency‑focused phishing operation, aligns with observed tactics where attackers host deceptive interfaces behind legitimate‑looking infrastructure to harvest credentials or lure victims into fraudulent crypto transactions.

Threat intelligence indicates the domain appears on a single security blocklist and has been actively blocked by PhishDestroy. VirusTotal analysis recorded four positive detections out of ninety‑five scanners, and Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious assessment. The IP address is located in Canada and is part of Cloudflare’s network, a common choice for attackers seeking anonymity and rapid content delivery.

Defenders should add retrobridge-portal.com and its resolving IP 172.67.174.217 to URL filtering and sinkhole lists, enforce DNS‑level blocking, and monitor outbound traffic for connections to the identified Cloudflare edge. User awareness campaigns should highlight the cryptocurrency phishing theme and the irrelevant page title to reduce click‑through rates. Continuous re‑evaluation of the domain’s status is advised, as the front‑end may change while the underlying phishing infrastructure remains active.