nidhisa20[.]github[.]io

PhishDestroy identifies nidhisa20.github.io as a live crypto drainer hosting active credential theft infrastructure. This GitHub Pages subdomain is currently distributing malware under the guise of a legitimate service, with confirmed malicious payload exfiltrating cryptocurrency wallet credentials. The threat remains active with elevated risk to unsuspecting visitors. nidhisa20.github.io was flagged by 13 of 95 VirusTotal security vendors and appears on one public blocklist. The domain resolves to IP 185.199.108.153 through GitHub, Inc. registration. This active crypto drainer mimics legitimate crypto services while executing unauthorized wallet transactions. Its SSL certificate from Let's Encrypt provides false trust indicators despite malicious intent. This domain represents immediate financial risk to cryptocurrency holders. PhishDestroy recommends immediate blocking at network and endpoint levels. Users should verify any crypto service URL through official channels before interaction. Security teams should investigate network logs for communications with 185.199.108.153. GitHub should be notified to suspend this fraudulent subdomain under their abuse policy. All cryptocurrency wallet access should use hardware wallet isolation until this threat is neutralized.