alokkumar1212[.]github[.]io

PhishDestroy flagged alokkumar1212.github.io as an active fake investment scam hosting under GitHub Pages. The domain is leveraging a generic username subdomain (alokkumar1212) to impersonate legitimate investment platforms, likely targeting cryptocurrency users with promises of high returns. No specific drainer kit or branded impersonation was detected in the initial analysis, suggesting a generic lure to harvest credentials or crypto wallet access.

This domain was flagged with a 12/95 detection ratio on VirusTotal as of the latest scan. It resolves to IP 185.199.108.153 and is registered under GitHub, Inc. via Let’s Encrypt SSL. The hosting environment indicates a recent GitHub Pages deployment, but the threat type and behavioral patterns suggest malicious intent in luring financial victims. No entries were found in Google Safe Browsing (GSB) at the time of analysis, and blocklist counts remain at zero, indicating a low detection footprint.

The domain remains active and under investigation as of seed 417f97. PhishDestroy recommends users avoid interacting with this domain and for organizations to implement network-level blocking of IP 185.199.108.153. Remaining risk is moderate due to the lack of blocklist presence and legitimate hosting infrastructure, enabling potential evasion of traditional defenses. Users are advised to report this domain to threat intelligence platforms and monitor for related activity.