nayan235[.]github[.]io

PhishDestroy identifies nayan235.github.io as a high-risk crypto drainer domain actively masquerading as a GitHub Pages host to harvest cryptocurrency wallet credentials and drain assets. The threat leverages GitHub’s trusted infrastructure to lower victim suspicion, embedding malicious JavaScript designed to intercept wallet connections and exfiltrate private keys or seed phrases. No known brand impersonation of major exchanges has been confirmed in open-source reporting, but the drainer kit is engineered to target MetaMask, Trust Wallet, and similar platforms directly through deceptive pop-ups and fake transaction prompts.

This domain was flagged by 15 out of 95 VirusTotal security vendors and resolves to IP 185.199.110.153. It is registered through GitHub, Inc. via GitHub Pages hosting, which allows rapid deployment under a legitimate provider but increases evasion potential. The SSL certificate is issued by Let’s Encrypt, ensuring encrypted communication to mask malicious traffic. While the exact creation date is not publicly available, the domain remains active and has not been flagged by Google Safe Browsing (GSB) as of latest checks. It has been reported on at least one public blocklist, though the total count is undisclosed.

As of current monitoring, nayan235.github.io remains active and poses ongoing risk to users visiting via phishing links or malvertising. No takedown or deactivation has been observed. Users are strongly advised to block access via network or browser filters and avoid interaction. Remaining risk is high due to GitHub’s legitimate reputation, evasion tactics, and active status. Always verify URLs, use hardware wallets, and inspect browser extensions for unauthorized permissions.