shalini31102[.]github[.]io

PhishDestroy identifies shalini31102.github.io as an active generic phishing domain hosting a crypto-currency drainer kit designed to harvest private keys and seed phrases. The domain does not impersonate a specific brand but instead presents a spoofed wallet-login interface to trick users into signing malicious transactions. The landing page leverages JavaScript-based drainer scripts embedded on the GitHub Pages site, which execute once a victim pastes credentials or connects a wallet.

Technical indicators confirm the threat: VirusTotal flags the domain at 13/95 security vendors, the IP 185.199.108.153 resolves to GitHub Pages infrastructure, and the domain is registered through GitHub, Inc. Google Safe Browsing categorizes it under SOCIAL_ENGINEERING with confirmed malicious activity. The SSL certificate issued by Let’s Encrypt provides a false sense of legitimacy, but the certificate’s short lifespan and issuance to a disposable GitHub Pages subdomain indicate opportunistic misuse.

As of the latest scan, the campaign remains active with no evidence of takedown. Users are advised to avoid clicking links to shalini31102.github.io and to verify any similar URLs using PhishDestroy’s real-time scanner. While the current risk is high due to active distribution and wallet-targeting behavior, proactive blocking and public reporting can reduce exposure. Remaining risk includes continued use in social media spam, DM campaigns on Telegram, and phishing forums. Immediate response includes domain blacklisting, browser-extension blocks, and wallet software warnings.