llori807[.]github[.]io

PhishDestroy identifies llori807.github.io as an active generic phishing host impersonating legitimate cryptocurrency services to trick victims into connecting malicious wallet drainer scripts. The domain serves no legitimate purpose and instead embeds a crypto-draining kit that silently siphons funds upon wallet connection. No brand is directly spoofed; the payload is generic and re-purposed across multiple similar campaigns to maximise opportunistic theft across different chains. llori807.github.io resolves to IP 185.199.108.153, is hosted on GitHub Pages via GitHub Inc., and leverages a Let’s Encrypt SSL certificate to appear trustworthy. According to VirusTotal, 4 out of 95 security vendors currently flag the domain. Google Safe Browsing lists it under SOCIAL_ENGINEERING for deceptive content. The domain was registered through GitHub’s Pages service and lacks any identifiable creation timestamp due to GitHub’s ephemeral naming convention for Pages sites. This domain remains ACTIVE as of the latest scan. Immediate response includes blocking 185.199.108.153 at the network perimeter and disabling access to llori807.github.io via DNS sinkhole or corporate blocklists. Users should treat this domain as HIGH RISK until further takedown; the persistence vector via GitHub Pages means full removal may require multi-party escalation. Remaining risk is elevated due to the drainer’s generic deployment model and SSL-backed deception. Continue monitoring feeds seeded by 8c0609 for newly observed sinkholes or replacement domains.