thepranav7[.]github[.]io

PhishDestroy identifies an active crypto drainer deployed on GitHub Pages at the domain thepranav7.github.io. This page is engineered to trick cryptocurrency users into connecting their wallets and unknowingly signing malicious transactions that drain assets. The threat actor leverages GitHub’s trusted *.github.io subdomain to lower victim suspicion while hosting a JavaScript-based drainer script that silently approves token transfers to attacker-controlled wallets. Security researchers have flagged this domain for social engineering tactics, indicating that visitors are being socially engineered into taking harmful actions such as approving malicious token permissions or initiating fraudulent transfers.

This domain was flagged by Google Safe Browsing as a SOCIAL_ENGINEERING site and remains completely undetected across VirusTotal’s 95 detection engines (16/95), suggesting either low prevalence or highly evasive payload delivery. Hosted on GitHub’s infrastructure via shared IP 185.199.108.153 and secured with a Let’s Encrypt SSL certificate, the site appears legitimate at first glance. Registration through GitHub, Inc. as a GitHub Pages site suggests a deliberate abuse of platform trust, enabling the threat actor to bypass traditional domain reputation scrutiny.

Users who visited thepranav7.github.io should immediately revoke any wallet connection permissions granted to the site through their wallet interface. Disconnect the site from your wallet, clear browser cache and cookies related to the domain, and run a malware scan. Report the domain to your wallet provider and file a complaint with Google Safe Browsing. Never approve unexpected token approval requests or transaction signatures from untrusted websites.