firdavsjons[.]github[.]io

PhishDestroy identifies firdavsjons.github.io as an active crypto drainer impersonating Trust Wallet, a leading cryptocurrency wallet platform. The domain is currently operational and poses an elevated risk to users who may inadvertently interact with the malicious page. This threat involves unauthorized cryptocurrency transfers facilitated through deceptive interfaces designed to mimic legitimate wallet services, specifically targeting Trust Wallet users. The domain's active status indicates ongoing malicious activity, requiring immediate scrutiny from security researchers and end-users alike.

This domain was flagged by 5 of 95 VirusTotal security vendors, demonstrating partial detection but insufficient protection against its crypto drainer operations. It resolves to IP address 185.199.108.153, which is registered through GitHub, Inc. using a Let's Encrypt SSL certificate. The domain's infrastructure leverages GitHub Pages for hosting, providing a veneer of legitimacy while concealing malicious intent. These technical indicators suggest a sophisticated operation designed to exploit user trust in established platforms like GitHub and Trust Wallet. The low VirusTotal detection rate highlights the challenge in identifying such threats through conventional means alone.

Given the elevated risk level and active status of firdavsjons.github.io, immediate action is recommended to prevent potential cryptocurrency losses. Users should avoid accessing this domain entirely and report it through official channels such as GitHub's abuse reporting system. Security teams are advised to block both the domain and its associated IP address (185.199.108.153) at the network perimeter. Additionally, cryptocurrency wallet users should verify all transaction requests through official applications and remain vigilant for similar deceptive domains. Continuous monitoring of this domain's infrastructure is essential as attackers may rapidly adapt their tactics to evade detection.