lkrishnaveni27990[.]github[.]io

PhishDestroy identifies lkrishnaveni27990.github.io as an active brand-impersonation domain using a crypto-draining kit to target Aave users. Hosted on GitHub Pages behind a Let’s Encrypt certificate, the page attempts to trick visitors into connecting their wallets and signing malicious transactions. Behavioral sandboxing confirms the drainer immediately attempts to swap tokens and drain balances once authorization is granted, indicating a live, in-the-wild campaign seeded 3040c5.

Technical indicators are precise: VirusTotal detection stands at 11 vendors out of 95 scanners (11.6 % coverage), the domain resolves to AS54113 (GitHub, Inc.) via IP 185.199.108.153, and the page was registered through GitHub’s Pages service with an SSL certificate issued by Let’s Encrypt. Google Safe Browsing currently lists the domain as unsafe and public blocklists aggregate at least five independent feeds, confirming cross-platform detection.

Current status remains active; the domain continues to serve the drainer payload with no takedown observed. PhishDestroy advises immediate network and endpoint blocking of the IP and domain, and recommends wallet users verify destinations via PhishDestroy before any transaction signing. Residual risk persists while the page remains live, with potential exposure to any user who accesses or clicks through from phishing lures.