wallet-bridge[.]com

This domain is flagged as a high-risk crypto drainer, designed to illicitly extract cryptocurrency from connected wallets by exploiting deceptive bridge functionality. Analysis indicates the site operates as a malicious intermediary, tricking users into authorizing transactions that drain funds from their wallets. The threat is classified as severe due to its direct financial impact and targeted nature against cryptocurrency holders.

Infrastructure analysis reveals the domain wallet-bridge.com resolves to IP address 5.231.234.175 and was registered through Porkbun LLC on April 25, 2026. It is currently offline but was previously active, with 16 out of 95 security vendors on VirusTotal flagging it as malicious. The domain appears on three security blocklists and is referenced in four AlienVault OTX threat intelligence pulses. The SSL certificate is issued by Let's Encrypt, a common tactic to appear legitimate. The page title, 'Walletbridge,' suggests an attempt to impersonate legitimate wallet bridging services, further corroborating its fraudulent intent.

Mitigation against crypto drainers like wallet-bridge.com requires immediate action from both users and security teams. Users should revoke any previously granted permissions to the domain via their wallet settings and verify all connected dApps for legitimacy. Security teams should block the domain and its resolving IP (5.231.234.175) at the network level, monitor for related indicators of compromise (IOCs), and alert users to avoid interacting with wallet bridging services that lack verifiable trust signals. Proactive measures include enforcing strict transaction approval policies and educating users on recognizing malicious smart contract interactions.