debridge[.]to

Analysis of debridge.to shows that the domain was registered on 24 August 2025 through the Government of the Kingdom of Tonga, a registrar often used by malicious actors to obscure ownership. The site presented the page title “www.www.debridge.to”, which does not reveal any legitimate brand and aligns with the reported crypto‑scam classification. Infrastructure inspection reveals the domain resolves to IP 198.18.0.39 and is served via Cloudflare, employing HSTS and HTTP/3, and presenting a Google Trust Services / WE1 SSL certificate.

Nameservers hera.ns.cloudflare.com and syeef.ns.cloudflare.com confirm the Cloudflare service. HTTP requests return a 403 status, and the domain is currently taken offline, a state corroborated by the blocklist entry from PhishDestroy and its presence on one additional security blocklist. VirusTotal analysis indicates that 14 of 95 scanning engines flagged the domain, reinforcing the malicious assessment.

While the exact phishing landing page content has not been captured, the combination of a recent registration date, use of a government registrar, Cloudflare front‑end, and the Crypto Scam label provides sufficient evidence for defensive actions. Defenders should add 198.18.0.39 to network blocklists, enforce DNS filtering for debridge.to, monitor Cloudflare‑associated CNAMEs, and ensure that any email or web traffic referencing the domain is quarantined. Continuous re‑evaluation is advised in case the site reappears, and any detections from endpoint security should be correlated with the observed VirusTotal flags.