heyraashiiii[.]github[.]io

PhishDestroy identifies heyraashiiii.github.io as an active crypto drainer phishing campaign hosted on GitHub Pages. This domain is engineered to trick users into connecting cryptocurrency wallets under the guise of a legitimate service, then draining funds via malicious smart contract interactions. The site leverages GitHub’s trusted infrastructure to appear credible while hosting malicious scripts that exfiltrate wallet credentials and initiate unauthorized transactions. Threat actors frequently exploit GitHub Pages due to its free hosting and high domain reputation, making it a prime vector for cryptocurrency theft. This campaign specifically targets users in crypto communities by impersonating trading platforms or wallet services.

GitHub-hosted domain heyraashiiii.github.io was registered through GitHub, Inc. and currently exhibits zero detections across 95 VirusTotal scanners as of the latest analysis. The domain resolves to IP address 185.199.108.153 and uses a Let’s Encrypt SSL certificate to enhance its legitimacy. While under investigation for generic phishing behavior, it has not yet been flagged widely, indicating a potentially emerging threat that may gain traction rapidly. Notable red flags include the unusual domain name structure designed for deception—likely a misspelled or exaggerated variation of a legitimate brand—and the absence of detection despite its active use. This pattern suggests the operators are testing new infrastructure to evade early detection systems.

Users who have visited heyraashiiii.github.io should immediately disconnect any connected cryptocurrency wallets, revoke any wallet permissions granted via the site, and transfer remaining assets to a clean wallet. Run a full antivirus scan and clear browser cache and cookies associated with the domain. Report the domain to your wallet provider and consider rotating all private keys if sensitive credentials were entered. Avoid re-visiting the domain and warn others in your network—especially those active in cryptocurrency—to prevent further victimization. Monitor all financial accounts for unauthorized transactions and report any suspicious activity immediately.