yaserwebdev[.]github[.]io

PhishDestroy identifies yaserwebdev.github.io as an active crypto drainer phishing domain registered on GitHub Pages with zero detections across 95 VirusTotal scanners as of seed 75a9e6. The site masquerades as a legitimate web development portal but loads malicious JavaScript designed to siphon cryptocurrency from victim wallets during transaction signing. No branded decoy (e.g., MetaMask, Trust Wallet) is explicitly mimicked in current payloads, suggesting opportunistic targeting rather than hardcoded impersonation. This domain was flagged on GitHub Pages infrastructure resolving to IPv4 185.199.108.153 via a Let’s Encrypt SSL certificate. Key indicators include: VirusTotal score 5/95 detections, registrar GitHub, Inc., IP autonomous system AS21654 (GitHub, Inc.), creation date undetermined (GitHub Pages defaults to epoch), Google Safe Browsing (GSB) status unlisted, and no public entries on major threat blocklists such as PhishTank or OpenPhish at this time. Persistence relies entirely on GitHub’s free hosting tier, giving operators low operational overhead and rapid deployment cycles. The campaign remains active per seed 75a9e6 with risk level under investigation due to undetected payloads and legitimate infrastructure abuse. Immediate response includes blocking the domain at DNS/edge levels and filing a GitHub abuse report referencing the drainer kit. Remaining risk is assessed as moderate: low detection rate delays takedowns, but GitHub’s rapid response to abuse complaints typically neutralizes such campaigns within hours. Users should avoid interacting with the site and scan wallet extensions for anomalous behavior.