abubakarcodeer[.]github[.]io

PhishDestroy identifies the domain abubakarcodeer.github.io as an active service hosting a generic crypto drainer kit designed to siphon funds from cryptocurrency wallets. This fraudulent site impersonates legitimate crypto projects or developers to deceive users into connecting their wallets, triggering unauthorized transactions. The campaign leverages GitHub Pages to host the malicious payload, ensuring a convincing facade while evading immediate takedowns due to GitHub’s infrastructure. No specific brand is directly impersonated in this instance, but the drainer is likely adapted for multiple crypto-related lures.

Technical indicators confirm elevated risk. The domain resolves to IP address 185.199.108.153 and is registered via GitHub, Inc. A Let’s Encrypt SSL certificate is active, giving the site an appearance of legitimacy. VirusTotal analysis shows 10 out of 95 security vendors flagged the domain as malicious. It has been blocked by OpenPhish and appears on one blocklist. While the exact creation date of the domain is not disclosed, its use in an active campaign suggests recent deployment. The combination of low detection ratios, a trusted hosting provider, and a drainer payload indicates a refined tactic used to bypass security controls.

This domain remains ACTIVE with an elevated risk level. Current response actions include blocking via OpenPhish and inclusion on one security blocklist. Despite these measures, 85/95 vendors did not flag the domain initially, creating a window of exposure. Users are advised to avoid accessing abubakarcodeer.github.io and never connect cryptocurrency wallets to unknown sites. GitHub should be notified to review and suspend the malicious repository. Final risk assessment: elevated due to active drainer payload and partial blocklist coverage.