gphillymath[.]org

This domain, gphillymath.org, was identified as a phishing site designed to steal cryptocurrency wallet credentials. Victims were likely lured into entering sensitive information such as private keys, seed phrases, or login details under the false pretense of accessing a legitimate service. The site specifically targeted users of decentralized finance platforms, exploiting trust in blockchain-related tools to facilitate unauthorized access to digital assets. Analysis indicates the domain was flagged by 12 out of 95 security vendors on VirusTotal, confirming its malicious nature. It was registered through NameSilo, LLC, and resolved to the IP address 172.67.136.244, which is associated with Cloudflare infrastructure. The domain also appeared in two threat intelligence pulses on AlienVault OTX and was listed on three security blocklists. Additional technical indicators include the use of HTTP/3 and an SSL certificate issued by Google Trust Services, which may have been leveraged to create a false sense of security for visitors. If you visited gphillymath.org or entered any credentials on the site, immediate action is required. First, disconnect any devices used to access the site from the internet to prevent further data exfiltration. Next, revoke access to any cryptocurrency wallets or accounts that may have been exposed by generating new private keys or changing passwords. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where possible. Report the incident to relevant security teams or platforms to help prevent further exploitation. Avoid reusing passwords or seed phrases across multiple services to mitigate the risk of secondary compromises.