delvusu[.]sbs

This domain, delvusu.sbs, is assessed at a high risk level and classified as a crypto drainer threat, specifically targeting users through Messenger brand impersonation to steal cryptocurrency wallet credentials. The domain is currently active and poses an immediate danger to visitors who may be tricked into connecting their wallets or providing sensitive financial information.

Technical indicators are strongly suspicious. VirusTotal reports 16 out of 95 security vendors flagging this domain as malicious. It is listed on 1 security blocklist and resolves to IP address 172.67.193.76. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar often associated with high-risk domains. It was created on June 25, 2026, which is a future date, indicating potential manipulation or data anomaly. The SSL certificate is issued by Google Trust Services / WE1, which is legitimate but commonly used by malicious sites to appear trustworthy. No trust score metrics are available, but the combination of a future creation date, low blocklist presence, and high vendor detection rate suggests active exploitation.

To mitigate this crypto drainer threat, users should immediately avoid visiting delvusu.sbs and never connect any cryptocurrency wallet or enter private keys, seed phrases, or login credentials on the site. Enable two-factor authentication on all crypto accounts and use wallet security features like transaction signing alerts. Report the domain to hosting providers and cybersecurity authorities. Regularly monitor cryptocurrency wallets for unauthorized transactions and consider using hardware wallets for high-value assets. Security teams should block the domain at the network level and update threat intelligence feeds.