sonny2k[.]github[.]io

PhishDestroy identifies sonny2k.github.io as an active crypto-draining fraud site hosted on GitHub Pages. This domain mimics legitimate services to trick users into connecting crypto wallets and authorizing malicious token transfers that silently drain funds. The threat is elevated due to the live domain, Let’s Encrypt certificate, and confirmed detections by 16 of 95 VirusTotal security engines. The IP 185.199.108.153 is a known GitHub Pages frontend, but attackers abuse the free hosting to serve phishing payloads while leveraging GitHub’s trustworthiness to bypass initial scrutiny. This domain was flagged by 16 out of 95 VirusTotal security vendors, indicating widespread suspicion yet ongoing availability. Registered through GitHub, Inc., the site uses a Let’s Encrypt SSL certificate to appear legitimate, and resolves to GitHub’s infrastructure at 185.199.108.153. Despite GitHub’s legitimate platform being abused, the domain was specifically created for malicious redirection and should not be trusted. If you visited sonny2k.github.io, immediately disconnect your wallet and revoke any unauthorized token approvals via your wallet’s “Revoke” or “Disconnect” functions. Do not interact further with the site. Scan your device with updated antivirus software and consider rotating wallet credentials. Report the domain to GitHub abuse and your wallet provider to help block follow-on attacks.