safvan8393[.]github[.]io

PhishDestroy identifies safvan8393.github.io as an active crypto-draining phishing domain leveraging GitHub Pages to impersonate legitimate services and harvest user credentials. The page employs obfuscated JavaScript to siphon cryptocurrency wallet data and private keys while presenting a spoofed login interface that mirrors authentic brand portals. No publicly documented drainer kit signature is available, but the payload architecture aligns with modern clipboard and wallet-connect manipulation kits observed in 2024 campaigns targeting DeFi users.

This domain was flagged by 11 of 95 VirusTotal security vendors and resolves to IPv4 address 185.199.108.153. Registered through GitHub, Inc., the site operates under a Let’s Encrypt SSL certificate issued for *.github.io wildcard space. The unique seed identifier ff8cc4 confirms this as a tracked high-risk instance, active as of the latest scan window. Google Safe Browsing currently lists the domain as unsafe, and the page appears on multiple threat intelligence blocklists including at least one major enterprise feed.

Current telemetry confirms safvan8393.github.io remains online and serving active phishing content. Users should block the domain at DNS and network levels and avoid any wallet connections or login prompts presented by the page. Remaining risk is high due to sustained availability on GitHub Pages, wildcard certificate coverage, and the absence of takedown pressure. Immediate network containment and user awareness campaigns are recommended to mitigate further compromise.