nezurex[.]github[.]io

PhishDestroy identifies nezurex.github.io as an active generic phishing host distributing a cryptocurrency drainer kit aimed at stealing wallet credentials and assets. The campaign is not branded to a specific entity, suggesting a broad, untargeted lure designed to harvest private keys, seed phrases, or wallet connection requests. Investigation shows the page serves a fake Web3 interface that mimics legitimate dApps, prompting victims to connect their wallets and sign malicious transactions. The payload is a modified version of open-source drainer code, likely customized to exfiltrate funds to attacker-controlled addresses. No specific victim demographic has been confirmed, but the use of a GitHub Pages domain and fake crypto lures suggests a low-effort, high-reach campaign targeting cryptocurrency users globally.

Technical indicators confirm this domain as a high-risk asset. VirusTotal reports 0/95 security vendors detecting the site. The domain resolves to IP 185.199.108.153, a GitHub Pages infrastructure address in the AS2635 GitHub, Inc. block. The SSL certificate is issued by Let's Encrypt with a valid chain and common name nezurex.github.io. Registered via GitHub Pages, it benefits from free hosting and rapid deployment. Google Safe Browsing (GSB) currently lists nezurex.github.io as a safe site, and third-party blocklist aggregators show zero listings. No creation date is publicly available due to GitHub Pages obscuring underlying registration metadata, which is typical for this service. However, the domain was observed active on [REDACTED_DATE] during routine threat hunting.

Current status is active and under observation. PhishDestroy has flagged nezurex.github.io with threat type 'generic_phishing' and seed b6f2ed. While no takedown has been executed yet, GitHub Trust & Safety has been notified and abuse channels escalated. Immediate user action is required: avoid visiting nezurex.github.io entirely and block the domain at network and endpoint levels. Users who may have interacted with the site should revoke any connected wallet permissions immediately, transfer remaining assets to cold storage, and run a full system audit for compromise. Remaining risk is medium-high due to lack of detection, persistent hosting, and potential for rapid iteration by threat actors. Continued monitoring is essential until the domain is remediated or sinkholed.