sanx001[.]github[.]io

PhishDestroy identifies the domain sanx001.github.io as an active crypto drainer phishing page targeting cryptocurrency users. The threat involves malicious JavaScript designed to drain wallet funds upon user interaction, posing significant financial risk to visitors. This domain is currently classified as high-risk and remains unresolved, requiring urgent intervention to prevent further victimization.

This domain resolves to IP address 185.199.108.153 and operates under a Let's Encrypt SSL certificate. Registered through GitHub, Inc., the domain was flagged by 20 of 95 VirusTotal security vendors, with Google Safe Browsing categorizing it under SOCIAL_ENGINEERING threats. The domain's low trust scores and high-risk classification indicate active malicious operations aimed at cryptocurrency theft. Technical indicators include suspicious behavior patterns consistent with crypto drainer toolkits, which intercept wallet connections and initiate unauthorized transactions.

The current status of sanx001.github.io remains active and unblocked by major browsers or security platforms. Immediate action is required: block this domain at network and endpoint levels, update firewall rules to prevent outbound connections, and warn cryptocurrency users to avoid interacting with this site. Security teams should investigate any recent outbound connections to this IP for signs of compromise. Continuous monitoring is advised due to the evolving nature of crypto drainer campaigns. Report this domain to relevant threat intelligence platforms to enhance collective defense against similar attacks.