mahsanabbasi[.]github[.]io

PhishDestroy identifies a new active crypto drainer campaign hosted at the GitHub Pages domain mahsanabbasi.github.io. This domain is currently being investigated as part of a broader campaign targeting cryptocurrency users through deceptive web interfaces. The infrastructure leverages GitHub’s free hosting service—commonly abused by threat actors to evade traditional email and domain-based security controls—and deploys a web-based wallet drainer designed to siphon funds from unsuspecting users under the guise of a legitimate service or tool.

This domain was flagged as a crypto drainer threat with 0 detections on VirusTotal out of 95 scanning engines as of seed analysis 2f6da6. It is registered via GitHub, Inc., resolving to IP address 185.199.108.153, with a valid Let’s Encrypt SSL certificate issued to support HTTPS obfuscation. The current blocklist count remains at 0, indicating a recently activated and undetected threat. The domain’s recent deployment and clean VT score suggest it is in the early stages of a campaign designed to evade immediate detection.

Users who have visited mahsanabbasi.github.io or interacted with its content should immediately cease any cryptocurrency-related transactions from the connected wallet. If you entered your wallet seed phrase, private key, or connected a wallet via this site, revoke all connected permissions immediately using tools like revoke.cash or wallet-specific dApps. Clear browser cache and cookies, and consider transferring any remaining funds to a new, offline wallet. Report the domain to GitHub Abuse and your local cybersecurity agency if you suspect exposure. Remain vigilant for follow-on phishing attempts tied to this campaign.