sudhss[.]github[.]io

This domain, sudhss.github.io, is actively hosting a phishing page designed to steal cryptocurrency wallet credentials through a fake authentication portal. The threat actor is leveraging GitHub Pages to distribute a convincing replica of a legitimate crypto wallet login interface, tricking users into entering their seed phrases or private keys. Once harvested, these credentials are used to drain digital asset wallets instantly, leaving victims with irreversible losses. The infrastructure is intentionally designed to appear legitimate via GitHub’s trusted domain and a Let’s Encrypt SSL certificate, increasing credibility and deception. PhishDestroy identifies this domain as a high-risk crypto credential theft site. The domain was registered through GitHub, Inc., and has been flagged by 12 out of 95 VirusTotal security vendors. Google Safe Browsing has categorized it under social engineering, specifically targeting users in cryptocurrency transactions. The site resolves to IP address 185.199.108.153 and is currently active with confirmed malicious activity. Users accessing this domain are immediately at risk of credential theft and subsequent financial fraud. If you or your users have visited sudhss.github.io, immediately disconnect from the internet and audit all cryptocurrency wallet applications and browser extensions for unauthorized access. Revoke any permissions granted to unknown or suspicious domains and transfer remaining funds to a newly created, isolated wallet. Report the domain to your antivirus provider and consider enabling hardware wallet authentication for all crypto accounts. Monitor blockchain transactions for unauthorized transfers. Never re-enter credentials or wallet recovery phrases after visiting this domain.