debridgesios[.]app

This domain is flagged as an elevated-risk credential harvesting operation targeting cryptocurrency wallet users. Analysis indicates the site masquerades as a legitimate business expense tracking service, specifically spoofing the DeBridge platform, to deceive victims into entering sensitive wallet credentials or private keys. The threat type is classified as cryptocurrency phishing, with a focus on credential theft and potential financial asset compromise. Infrastructure analysis reveals the domain was registered on April 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.96.3, which is routed through Cloudflare, a common tactic to obscure hosting origins and evade takedowns. Detection metrics show 7 out of 95 security vendors on VirusTotal flag the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on three security blocklists and is actively blocked by cryptocurrency-specific security tools, including MetaMask and PhishDestroy. The page title, "DeBridge — Smart Business Expense Tracker," further confirms the impersonation of the legitimate DeBridge service. Mitigation requires immediate domain blacklisting across security gateways and endpoint protection systems. Network administrators should block traffic to 188.114.96.3 and monitor for connections to newly registered domains under NICENIC INTERNATIONAL GROUP CO., LIMITED. Cryptocurrency users should verify domain authenticity before entering credentials and enable hardware-based or multi-factor authentication for wallet access. Security teams are advised to conduct retrospective analysis for connections to this IP or domain within the past 30 days to identify potential credential exposure. Given the domain's current offline status, continuous monitoring for re-registration or DNS changes is recommended.