aps-abesfreshie[.]github[.]io

PhishDestroy identifies aps-abesfreshie.github.io as an active crypto drainer campaign exploiting GitHub Pages to deceive users into connecting wallets. This domain mimics legitimate brand names to trick victims into signing malicious transactions that silently drain cryptocurrency funds. The page likely embeds a drainer script (e.g., Rainbow or Dex drainer variants) that executes when a wallet is connected, targeting tokens across multiple chains including Ethereum and Solana. Given the operational nature and use of obfuscation, this represents a high-risk threat to individual and institutional crypto holders.

This domain was flagged with a threat score of 17/95 by VirusTotal security vendors. It is registered via GitHub, Inc., resolving to IP 185.199.111.153 with a Let’s Encrypt SSL certificate. The domain currently appears on 1 security blocklist and remains unblocked by Google Safe Browsing (GSB), indicating elevated exposure. Technical telemetry suggests recent deployment, though precise creation date is not publicly disclosed due to GitHub’s privacy model. The combination of low VT coverage, SSL encryption, and active hosting on a trusted platform increases the risk of successful deception.

As of the latest scan, aps-abesfreshie.github.io remains active and is actively blocked by OpenPhish, confirming ongoing malicious activity. Users are strongly advised not to interact with this domain or any linked pages. If exposure has occurred, immediately revoke any connected wallet permissions, transfer remaining assets to a clean wallet, and monitor blockchain transactions for unauthorized transfers. Organizations should update threat intelligence feeds and browser blocklists to include this domain. Remaining risk remains elevated due to the domain’s active status and the continued use of trusted hosting platforms by threat actors.