nagamanip1702[.]github[.]io

PhishDestroy identifies nagamanip1702.github.io as an active cryptocurrency drainer phishing domain, leveraging a spoofed interface to trick users into connecting fraudulent wallets. The domain mimics legitimate crypto platforms, suggesting a targeted attempt to harvest private keys and drain victim funds. Security teams should treat this as a high-fidelity threat due to its operational infrastructure and multi-engine detection coverage.

The domain resolves to IP 185.199.108.153 and is registered through GitHub, Inc., with a Let's Encrypt SSL certificate in place. VirusTotal analysis shows 14 out of 95 security vendors flagging this domain, indicating partial but not universal detection. The GitHub-hosted nature and IP allocation suggest opportunistic abuse of a trusted platform to host malicious content, while the SSL certificate may be used to lend superficial legitimacy to the phishing page. No specific brand is directly impersonated in the known intelligence, pointing to a generic but high-risk drainer campaign.

This domain remains active and poses an elevated risk to cryptocurrency users. Immediate mitigation includes blocking the domain at DNS and network levels, flagging the associated IP (185.199.108.153), and monitoring for related wallet drain events. Despite the elevated status, the partial detection rate and reliance on GitHub hosting suggest this campaign may still be evolving. Organizations should prioritize user awareness training focused on wallet connection security and implement real-time transaction monitoring to detect anomalous outflows linked to this infrastructure.