shambhaviranjan[.]github[.]io

The domain shambhaviranjan.github.io has been classified as a high-risk crypto drainer, designed to steal digital assets by tricking users into connecting their wallets to a malicious smart contract. This site does not merely mimic a brand—it actively targets cryptocurrency users with a drainer kit embedded in its frontend code, intercepting transactions and draining funds upon approval. Security researchers have identified behavioral patterns consistent with automated wallet drainers, including fake airdrop claims and deceptive “connect wallet” prompts that lead to irreversible fund loss. This domain is not a passive phishing page—it is an active financial threat vector operating under the guise of a GitHub-hosted project. This domain was flagged by Google Safe Browsing as a phishing site and is currently resolved to IP 185.199.108.153. VirusTotal analysis shows 18 out of 95 security vendors detecting malicious content, indicating moderate but significant detection coverage. Registered through GitHub, Inc., the site leverages GitHub Pages infrastructure, which complicates takedown due to GitHub’s hosting policies. No public creation date is listed, but the domain has been active long enough to amass multiple blocklist entries and trigger automated detection systems. Its reliance on GitHub’s trusted domain reputation adds a layer of deception, making it easier to bypass browser-based warnings and social engineering filters. The domain remains active as of the latest assessment. GitHub has not yet suspended the repository, despite multiple abuse reports and third-party detections. Users are strongly advised not to interact with this domain under any circumstances. PhishDestroy continues to monitor the site and has updated its blocklist to include shambhaviranjan.github.io across all detection endpoints. While the immediate risk can be mitigated through blacklisting and browser filters, the underlying drainer remains operational, posing a latent threat to any visitor who bypasses warnings. Given the site’s confirmed malicious functionality and active status, the residual risk remains HIGH. Users should verify any similar links using PhishDestroy before engaging.