tamaratav[.]github[.]io

PhishDestroy identifies tamaratav.github.io as a high-risk crypto drainer domain actively harvesting cryptocurrency wallet credentials. This GitHub Pages-hosted site (IP 185.199.108.153) employs a Let's Encrypt SSL certificate to appear legitimate while executing malicious JavaScript payloads designed to drain connected crypto wallets. The threat involves social engineering tactics to trick users into connecting wallets to fraudulent dApps, with immediate fund extraction upon authorization. Given the active status and 12 confirmed detections out of 95 security vendors on VirusTotal, this represents an imminent financial risk to cryptocurrency users. This domain was flagged by PhishDestroy with the following technical indicators: it resolves to IP 185.199.108.153, is registered through GitHub Inc.'s Pages service, and maintains active status despite 12/95 security vendors detecting malicious content. The Let's Encrypt SSL certificate provides a false sense of security while facilitating man-in-the-middle interception of wallet communications. While specific creation dates and blocklist participation metrics aren't publicly available, the combination of GitHub hosting, active status, and moderate detection rate suggests either a recently deployed threat or one that's successfully evading some detection mechanisms. The 12.6% vendor detection rate indicates potential blind spots in automated scanning systems. Users should immediately cease all interactions with this domain and verify their wallet connections using PhishDestroy's independent verification service. For crypto drainer threats specifically: 1) Never connect wallets to unfamiliar sites, 2) Use hardware wallets for high-value transactions, 3) Verify URLs through official channels before any connection, and 4) Monitor wallet activity continuously for unauthorized transactions. Consider revoking any previously granted wallet connections to this domain through your wallet's connection management interface. GitHub Pages users should note that malicious actors frequently exploit free hosting services, making independent verification essential before any cryptocurrency-related interaction.