photonbridge[.]io

photonbridge.io is currently active and has been identified as a wallet‑connect phishing site that impersonates the Discord brand. The page title returned by the server is “Photon Bridge”, and the scam type is explicitly listed as wallet_connect_phish. The domain was registered on 28 Nov 2024 through NameCheap, Inc.

Infrastructure analysis shows the domain resolves to the IPv4 address 34.116.250.251, which is hosted in Poland under AS396982 owned by Google LLC. The authoritative nameservers are elmo.ns.cloudflare.com and rita.ns.cloudflare.com, indicating Cloudflare DNS services. The site serves HTTP with status code 200 and presents no TLS certificate, leaving traffic unencrypted.

Threat intelligence sources have flagged photonbridge.io on four security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. Multiple security scanners have reported ten detections out of ninety‑five vendors, confirming a consensus of malicious intent. The domain’s activity aligns with a brand‑impersonation campaign targeting Discord users via wallet‑connect flows.

Open questions remain regarding the exact payload delivered after the initial wallet‑connect interaction, as no page content has been publicly disclosed. The absence of TLS also raises the possibility of network‑level interception. While the IP address is hosted by a major cloud provider, the specific server instance appears to be dedicated to the phishing operation, but further forensic capture would be required to map any additional infrastructure.

Defenders should immediately block photonbridge.io and its resolved IP address at perimeter and DNS layers. Updating intrusion detection signatures to catch HTTP requests to the “Photon Bridge” title and monitoring for Discord wallet‑connect API calls can help detect compromised users. Continuous re‑evaluation of the associated IP and any newly observed sub‑domains is advised, as the operator may shift hosting while retaining the same domain registration.