Yggdrasil

The website uses classic social engineering tactics, promising to 'fix wallet glitches' and 'rectify issues' to trick users into connecting and compromising their cryptocurrency wallets. +1 more

The website claims to be an official national digital certificate system involving the Central Bank of Costa Rica and SUGEF, but is hosted on a 'workers.dev' subdomain instead of a legitimate '.go.cr' or '.fi.cr' government domain. +1 more

The domain uses a common phishing pattern by adding 'official' to a brand name and using a .shop TLD rather than the legitimate fixitsticks.com domain. +1 more

The domain southwest-air.com.ru is a clear impersonation of the official southwest.com domain, using a Russian top-level domain for a US-based airline. +1 more

The domain 'bet365-lisbon.com' is not an official domain for the Bet365 brand and follows a common pattern used by phishing or unauthorized affiliate sites to lure users. +1 more

The website is hosted on a 'pages.dev' subdomain, a free platform frequently used to host phishing sites, rather than an official Shopee corporate domain. +1 more

The domain 'googlemeeets.click' uses a typosquatted version of 'google' and an extra 'e' in 'meets', which is a classic phishing technique. +1 more

The domain star-casino-brisbane.com is a spoof of the official 'The Star Brisbane' brand which uses the domain thestarbrisbane.com.au. +1 more

The website is hosted on a free 'pages.dev' subdomain, which is a common practice for malicious sites to bypass reputation filters and avoid domain costs. +1 more

The website uses the official Ziraat Bankası logo and branding on the suspicious domain 'ziraatoffshore.online', which is not an official domain for this major Turkish financial institution. +1 more

The website encourages users to download an APK file directly, which is a high-risk activity that bypasses official app store security checks. +1 more

The domain ledgr-wallet-eng.pages.dev uses a typo-squatted version of 'Ledger' and is hosted on a free Cloudflare Pages subdomain, which is highly inconsistent with the official brand site. +1 more

The URL uses a suspicious subdomain on a free hosting platform (pages.dev) and contains typosquatting ('portel' instead of 'portal') to mimic the official Ledger brand. +1 more