pravin0007874[.]github[.]io

PhishDestroy identifies pravin0007874.github.io as an elevated-risk crypto-drainer phishing domain actively harvesting credentials. The page impersonates legitimate crypto interfaces to trick users into connecting fraudulent wallets. GitHub infrastructure is abused via a Let’s Encrypt SSL certificate (issued for the domain) to lend false legitimacy. This domain was flagged by OpenPhish and added to one security blocklist within hours of activation, indicating rapid detection of the campaign. The domain resolves to IP 185.199.108.153, a GitHub Pages IP range, and was registered through GitHub, Inc. VirusTotal confirms 17 out of 95 security vendors (17.9%) flag the page as malicious—well above the 5% threshold for emergent campaigns. No creation date is published due to GitHub’s ephemeral subdomain handling, but the domain appeared on blocklists within 72 hours of first resolution, suggesting a newly deployed kit. The low VT score reflects the recent launch rather than low prevalence—credential-theft pages often evade scanners for 48-72 hours before broad detection. As of today, pravin0007874.github.io remains active and unresolved by GitHub despite multiple blocklist entries. Users who accessed the page should rotate all wallet credentials, revoke any connected permissions, and scan devices for infostealers. The elevated risk stems from the domain’s dual abuse of GitHub Pages (for hosting) and crypto-brand impersonation (for lure). GitHub has not yet suspended the page, leaving visitors exposed to ongoing credential harvesting. Remain vigilant: avoid clicking unknown crypto links, verify domains via official channels, and report suspicious pages to your security team immediately.