cllicksbus[.]com

PhishDestroy identifies cllicksbus.com as a crypto drainer site, masquerading as a legitimate bus ticket booking service to trick users into connecting crypto wallets and draining funds. The domain lures victims with fake promotions or discounted fares, only to execute malicious JavaScript upon wallet connection. Attackers exploit social engineering by leveraging the trust associated with bus ticketing brands, creating a false sense of urgency to pressure users into making impulsive transactions. This domain was flagged by 13 out of 95 VirusTotal security vendors, indicating elevated malicious activity. Registered through Fewmoretaps OU d/b/a Trustname.com, the domain was created on March 13, 2026, and resolves to IP 216.150.1.1. Its SSL certificate, issued by Let’s Encrypt, adds superficial legitimacy, masking its true intent. The low detection rate at time of analysis suggests this is a recently deployed threat, likely part of a broader campaign targeting cryptocurrency users. Users who visited cllicksbus.com should immediately disconnect any connected wallets, revoke any suspicious permissions, and scan devices for malware. Do not interact with the site or enter any credentials. Report the domain to your organization’s threat intelligence team or to platforms like PhishDestroy for takedown. If funds were stolen, file a report with local law enforcement and your wallet provider. Monitor financial accounts closely for unauthorized transactions.