com-sharel[.]ink

This domain, com-sharel.ink, functions as a crypto drainer phishing site designed to illicitly extract cryptocurrency assets from victims by impersonating legitimate wallet or exchange interfaces. Analysis indicates the domain employs deceptive tactics, including the use of reCAPTCHA and HSTS to appear credible, while targeting users through fraudulent transaction prompts or wallet connection requests. The infrastructure leverages Cloudflare for hosting, which may obscure the true origin of the attack and complicate mitigation efforts. Infrastructure analysis reveals the domain was registered on June 12, 2024, through GoDaddy.com, LLC, a registrar frequently exploited for malicious campaigns due to its accessibility. The domain resolves to the IP address 188.114.97.3 and is currently flagged by 3 out of 95 security vendors on VirusTotal, indicating low initial detection but elevated risk due to its presence on four distinct security blocklists. Additional threat intelligence confirms its inclusion in one AlienVault OTX pulse, further corroborating its malicious classification. The SSL certificate, issued by Google Trust Services, adds a layer of apparent legitimacy, which may deceive unsuspecting users. Users who interacted with com-sharel.ink should immediately revoke any connected wallet permissions and transfer remaining assets to a secure, unrelated wallet. It is critical to monitor transaction histories for unauthorized activity and report the incident to relevant blockchain security platforms. Given the domain’s current offline status, victims should remain vigilant for follow-up campaigns, as threat actors often reuse infrastructure or pivot to similar domains. Security teams are advised to block the domain and associated IP address at the network level to prevent further exposure.