parth-soni10[.]github[.]io

PhishDestroy identifies the GitHub-hosted site parth-soni10.github.io as an active social-engineering fake-login phishing domain. This page is designed to trick users into surrendering credentials under false pretenses, leveraging social-engineering tactics rather than a dedicated cryptocurrency drainer kit. The platform impersonates legitimate login flows but does not embed a known drainer script; instead, it harvests credentials via deceptive input forms. Analysis shows the threat aligns with Google Safe Browsing’s SOCIAL_ENGINEERING classification, indicating a focus on fraudulent authentication rather than direct fund extraction.

This domain presents clear technical indicators for takedown and blocking. VirusTotal flags it at 5/95 security vendors, with Google Safe Browsing explicitly marking it SOCIAL_ENGINEERING. It resolves to IP 185.199.108.153 and is registered through GitHub, Inc. using a Let’s Encrypt SSL certificate. While the exact creation timestamp is not provided, the active status and persistent hosting on GitHub Pages indicate recent deployment and ongoing availability. The 5/95 detection ratio suggests moderate but growing recognition across security platforms.

As of the latest scan, the domain remains active with elevated risk and no remediation observed. GitHub has not yet suspended the repository hosting the page, allowing continued user exposure. Immediate blocking is recommended via network and DNS filters referencing the domain, IP, and SSL fingerprint. Users are advised to verify any suspicious login prompts using PhishDestroy and avoid entering credentials on untrusted pages. The residual risk remains high due to hosting persistence and lack of takedown intervention.