us71web-share[.]click

This domain, us71web-share.click, is identified as a crypto wallet drainer scam designed to illicitly extract digital assets from victims' cryptocurrency wallets. Analysis of the page title, about:privatebrowsing, suggests an attempt to mimic legitimate browser behavior while executing malicious scripts in the background. The threat specifically targets users of decentralized finance (DeFi) platforms and cryptocurrency wallets, tricking them into connecting their wallets to a fraudulent interface that drains funds upon interaction. The presence of wallet-specific blocking by MetaMask further corroborates the domain's association with crypto asset theft rather than generic credential harvesting or brand impersonation schemes. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification of us71web-share.click. The domain was registered through Dynadot LLC on February 21, 2026, with a creation date significantly ahead of the current year, a common tactic to evade immediate detection. It resolves to the IP address 109.69.58.121, hosted on an Ubuntu server running Nginx, a configuration frequently observed in phishing and scam operations. VirusTotal reports that 5 out of 95 security vendors flag the domain as malicious, while it appears on three independent security blocklists, including SEAL and PhishDestroy. The Gridinsoft trust score of 0/100 further underscores the domain's high-risk profile. Users who have visited us71web-share.click or interacted with its content should take immediate remedial actions to mitigate potential financial losses. First, disconnect any cryptocurrency wallets linked to the domain and revoke all associated smart contract approvals using a trusted blockchain explorer. Monitor wallet transactions for unauthorized activity and transfer remaining assets to a new, secure wallet if suspicious interactions are detected. Additionally, clear browser cache and cookies to eliminate residual session data that may facilitate further exploitation. Given the domain's offline status, users should remain vigilant for similar scams employing comparable infrastructure or social engineering tactics, particularly those impersonating browser functions or DeFi platforms.