hassansidiqui[.]github[.]io

PhishDestroy identifies a crypto drainer campaign hosted at hassansidiqui.github.io, a GitHub Pages domain leveraging brand impersonation tactics to trick users into connecting crypto wallets. Security researchers assess this domain as actively malicious, with threat actors distributing links through deceptive social media posts or fake giveaways to harvest wallet credentials and drain funds. The page masquerades as a legitimate cryptocurrency service while silently executing unauthorized transactions upon wallet connection.

Evidence gathered from multiple threat intelligence sources confirms this domain's malicious intent. VirusTotal currently rates it at 18/95 detections, indicating it remains undetected by most antivirus engines. The domain resolves to IP address 185.199.108.153, registered through GitHub Inc. with a valid Let's Encrypt SSL certificate likely used to establish credibility. Google Safe Browsing has already blacklisted this domain under the SOCIAL_ENGINEERING category, signaling immediate risk to visitors.

Users who accessed this domain should assume their system may have been compromised. Immediately disconnect any cryptocurrency wallets and revoke all permissions through official wallet interfaces or blockchain explorers. Clear browser cache and cookies, then perform a full antivirus scan using updated security software. Consider rotating all cryptocurrency wallet addresses and private keys as a precautionary measure. Report this incident to your organization's SOC team if work-related assets were involved.