harshitasinha456-sys[.]github[.]io

PhishDestroy identifies harshitasinha456-sys.github.io as an active crypto drainer deployed on GitHub Pages to steal cryptocurrency wallet credentials and private keys. This domain serves a convincing fake login interface that prompts victims to connect their wallets under the guise of authenticating for airdrops, staking rewards, or account verification. Once a user enters wallet credentials or approves a malicious transaction, the drainer immediately siphons tokens from the connected wallet, often exploiting ERC-20 token approvals and signature-based attacks to execute unauthorized transfers. The domain leverages GitHub’s reputable infrastructure—via GitHub Pages and a Let’s Encrypt SSL certificate—to appear legitimate, a tactic commonly used to bypass browser warnings and user skepticism. This domain was flagged by PhishDestroy under seed 8a9c3e after being detected engaging in credential harvesting and crypto theft. VirusTotal analysis confirms that 10 out of 95 security vendors have marked it as malicious, indicating moderate detection coverage but not universal recognition. The domain is hosted on GitHub Pages, a legitimate service often abused by threat actors, and resolves to IP address 185.199.108.153, which is associated with multiple suspicious domains. While the exact creation date is not publicly available, the domain’s recent activity and low age suggest it is part of a rapidly evolving campaign targeting cryptocurrency users. The presence of a valid SSL certificate issued by Let’s Encrypt further enhances the domain’s credibility, making it more likely to deceive non-technical users. Users who have visited harshitasinha456-sys.github.io should immediately disconnect their wallets, revoke any unauthorized token approvals via tools such as revoke.cash, and scan their devices for malware using reputable antivirus software. Do not enter any credentials or connect your wallet to this site. If you interacted with this domain, check your wallet transaction history for unauthorized transfers and consider moving remaining assets to a new wallet with a different seed phrase. Report the domain to PhishDestroy and your browser’s safe browsing service to help block future access. Always verify the legitimacy of crypto-related websites by cross-referencing official channels and use hardware wallets for enhanced security.