mrqadir090-qadir[.]github[.]io

PhishDestroy identifies mrqadir090-qadir.github.io as a fraudulent GitHub Pages domain distributing a fake MetaMask wallet login page designed to steal cryptocurrency from visitors. The page mimics the legitimate MetaMask interface, tricking users into entering their seed phrases or connecting wallets that drain balances instantly. Technical analysis confirms this domain serves a JavaScript-based crypto drainer that intercepts wallet connections and authorization requests, redirecting assets to attacker-controlled addresses. This is not a generic phishing attempt—it is a specialized crypto theft operation with automated fund extraction capabilities. This domain was flagged by PhishDestroy’s automated crawlers and confirmed through VirusTotal analysis showing zero detections out of 95 security engines as of the investigation timestamp. The site resolves to IP address 185.199.110.153, hosted on GitHub Pages infrastructure under the GitHub, Inc. registrar. The SSL certificate is issued by Let’s Encrypt, suggesting an attempt to appear legitimate. While GitHub Pages is a trusted platform, threat actors frequently abuse it to host fraudulent crypto services due to its high reputation and low barrier to deployment. If you visited this site: DO NOT enter any wallet credentials, seed phrases, or private keys. Disconnect your wallet immediately and revoke any unauthorized connections via your wallet’s security settings. Scan your device with updated antivirus software and consider transferring remaining funds to a new wallet. Report this domain to PhishDestroy and GitHub abuse channels to help block further abuse. Always verify crypto websites by checking official URLs and using PhishDestroy’s real-time verification tool before interacting.