premcreates[.]github[.]io

PhishDestroy identifies premcreates.github.io as an active crypto drainer phishing domain targeting unsuspecting cryptocurrency users through deceptive GitHub-hosted pages. This threat employs social engineering tactics to trick victims into connecting malicious wallet drainers or submitting private keys under the guise of legitimate services. The domain currently remains live and unpatched, actively harvesting digital assets from compromised user wallets. This domain was flagged by 17 of 95 VirusTotal security vendors, operates under GitHub, Inc. as registrar, and resolves to IP address 185.199.108.153 using a valid Let's Encrypt SSL certificate. Premcreates.github.io has been listed on 1 security blocklist including OpenPhish and triggered Google Safe Browsing's SOCIAL_ENGINEERING classification. The infrastructure exhibits low trust metrics across security platforms due to its recent deployment and malicious payload characteristics. Despite widespread detection, premcreates.github.io continues to function as an active threat vector with high-risk potential for financial loss. Immediate action is required: avoid all interaction with this domain, verify any similar services through PhishDestroy's database, and report wallet connections to blockchain security teams. Users should also scan connected wallets using tools like Revoke.cash or Wallet Guard to identify any unauthorized smart contract approvals.