charlie16128[.]github[.]io

PhishDestroy identifies the domain charlie16128.github.io as an active crypto drainer phishing page deployed on GitHub Pages. This domain mimics legitimate cryptocurrency wallet interfaces to trick users into connecting their wallets and signing malicious transactions. The infrastructure suggests a low-effort, high-reward campaign targeting users in the crypto space, exploiting GitHub's trusted hosting to bypass security controls. No specific drainer kit (e.g., MetaDrainer, Angel Drainer) was identifiable from the available telemetry, but the domain's configuration aligns with common crypto-draining tactics, including SSL encryption and prompt redirection to wallet connection prompts.

Domain charlie16128.github.io resolves to IP 185.199.108.153 (GitHub Pages infrastructure) via a Let's Encrypt SSL certificate. Registered through GitHub, Inc., this domain has been active since at least the seed reference date (bc00d0), with VirusTotal detection at 11/95 security vendors and presence on 1 blocklist (OpenPhish). The low VT detection rate and use of GitHub's CDN highlight a cat-and-mouse evasion strategy, leveraging legitimate infrastructure to host malicious content. Despite blocking by OpenPhish, the domain remains accessible via direct navigation or referrals, indicating limited proactive takedown efforts at the registrar level.

As of the latest telemetry, this domain remains ACTIVE and poses an ELEVATED RISK due to its crypto-draining objective and partial evasion of blocklists. Immediate actions include blocking the domain at DNS/endpoint levels and reporting to GitHub Trust & Safety for abuse review. Users should avoid accessing the domain, verify links via alternate sources, and monitor wallet transactions for unauthorized activity. The remaining risk is MODERATE given the domain's hosting on GitHub (which may respond to abuse reports) but LOW due to the high potential impact of crypto drainers. Monitor for updates as this campaign evolves.