672361[.]com

This domain, 672361.com, is flagged as a high-risk crypto drainer site designed to impersonate the U8 EXCHANGE platform. Crypto drainers are malicious scripts that automatically siphon cryptocurrency from connected wallets once a user interacts with the site, often through deceptive prompts or fake transaction approvals. The site’s page title, U8 EXCHANGE, is used to trick users into believing they are accessing a legitimate cryptocurrency exchange, increasing the likelihood of financial theft. Given its active status and the nature of the threat, visitors are at immediate risk of unauthorized asset transfers if they connect their wallets or input sensitive information. Analysis indicates that 672361.com was registered on December 03, 2025, through Metaregistrar BV, a registrar frequently associated with recently created malicious domains. The domain resolves to the IP address 192.238.187.239, hosted under AS138995 (Antbox Networks Limited) in Hong Kong, an autonomous system with a history of hosting phishing infrastructure. VirusTotal detection data reveals that 8 out of 95 security vendors have flagged this domain as malicious, with specific detections for generic phishing and crypto-related fraud. Additionally, the domain appears on three security blocklists, including those maintained by specialized threat intelligence providers, further confirming its malicious intent. The SSL certificate issued by Let’s Encrypt (YR1) does not mitigate the risk, as legitimate certificates are commonly abused by threat actors to lend false credibility to phishing sites. If a user has visited 672361.com, immediate action is required to mitigate potential financial loss. First, disconnect any wallets or accounts that may have been linked to the site. Review all recent transactions for unauthorized activity, particularly those involving cryptocurrency transfers. If funds were transferred, report the incident to the relevant blockchain explorer and consider filing a complaint with local cybercrime authorities. Users should also scan their devices for malware, as some crypto drainers deploy additional payloads to maintain persistence. To prevent future incidents, avoid interacting with domains registered within the last 30 days, particularly those impersonating financial or cryptocurrency services. Always verify the legitimacy of a site through official channels before entering sensitive information or connecting wallets.