alirazamalik78183-crypto[.]github[.]io

The domain alirazamalik78183-crypto.github.io is flagged as a high-risk phishing site. It is designed to mimic the Instagram login page, aiming to steal user credentials and personal information. The threat type is categorized as generic_phishing, and there is no evidence of a specific drainer kit being used.

Analysis indicates that the domain has a VirusTotal score of 7/95, with 7 security vendors identifying it as a threat. The domain is registered through GitHub, Inc., and resolves to the IP address 185.199.109.153, which is located in the United States and associated with AS54113 Fastly, Inc. The SSL certificate is issued by Let's Encrypt, using the R12 algorithm. The domain appears on one security blocklist and is currently blocked by PhishDestroy.

The domain remains active, posing a significant risk to users who may inadvertently visit the site. Immediate response actions should include further analysis of the site's content, monitoring for additional malicious activities, and informing affected users to change their passwords. Despite the current blocklist and blocking measures, the domain's high risk level suggests ongoing vigilance and user education are necessary to mitigate potential damage.