ghost32-bifrost[.]netlify[.]app

This domain, ghost32-bifrost.netlify.app, is currently flagged as a high-risk phishing resource targeting users of the Bifrost cryptocurrency wallet. The site impersonates the legitimate Bifrost platform, as evidenced by its page title 'Bifrost | Home,' and remains actively accessible. Analysis indicates the domain is designed to harvest sensitive credentials, including private keys or recovery phrases, from unsuspecting victims under the guise of a trusted service. Infrastructure analysis reveals the domain is hosted on Netlify’s platform and resolves to the IPv6 address 2a05:d014:58f:6200::259, geolocated in Germany under Amazon.com, Inc.’s AS16509. Security vendor detections report 13 of 95 engines on VirusTotal have flagged the domain as malicious. The SSL certificate, issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), provides encrypted connections but does not mitigate the underlying phishing threat. The domain appears on at least one security blocklist, and its active status suggests ongoing malicious activity. Current findings confirm the domain remains operational and continues to pose a significant risk to cryptocurrency users. Immediate mitigation steps include blocking the domain at the network level, revoking any associated SSL certificates, and notifying the hosting provider for takedown. Users are strongly advised to verify domain authenticity before entering credentials and to employ multi-factor authentication where available. Organizations should update endpoint protection rules to include this domain and monitor for related indicators of compromise.