prianshuamarkhalde[.]github[.]io

PhishDestroy identifies prianshuamarkhalde.github.io as an active crypto drainer phishing campaign, classified at elevated risk and currently unresolved. This GitHub.io subdomain mirrors legitimate services to trick users into connecting wallets and approving malicious token approvals intended to drain crypto funds. The campaign shows active hosting infrastructure and continues to operate without takedown, posing a direct financial threat to cryptocurrency users who approve transaction requests on site.

This domain was flagged by 11 of 95 VirusTotal security vendors, indicating significant malicious detection. It resolves to IP address 185.199.110.153, registered through GitHub, Inc. and secured with a Let's Encrypt SSL certificate. The subdomain was created under GitHub Pages, leveraging the platform’s trusted infrastructure to host fraudulent content. Historical analysis shows limited longevity and minimal reputation across threat intelligence feeds, with no positive trust scores recorded. Multiple domain and IP blocklists already include this indicator, reinforcing its malicious classification.

The active status of this campaign requires immediate preventive action. Users should block prianshuamarkhalde.github.io at the network and DNS level. Do not visit or interact with this domain or any links derived from it. Review wallet approvals and revoke suspicious permissions immediately. For organizations, deploy DNS filtering rules to prevent access and monitor outbound connections to associated IP ranges. Report this indicator to security teams and threat intelligence platforms to aid in global blocking efforts. Exercise heightened scrutiny of any GitHub Pages domains offering crypto-related services.