mahmadv3101-cpu[.]github[.]io

PhishDestroy identifies mahmadv3101-cpu.github.io as a brand impersonation domain actively distributing a crypto drainer kit. This GitHub-hosted page mimics legitimate services to trick users into connecting crypto wallets, enabling unauthorized fund transfers. The domain leverages GitHub Pages to evade traditional email filters, positioning itself as a trusted platform while hosting malicious JavaScript payloads designed to drain digital assets from connected wallets.

Technical indicators confirm elevated risk: VirusTotal reports 6 out of 95 security vendors flagged this domain, with Google Safe Browsing classifying it under SOCIAL_ENGINEERING. Registered through GitHub, Inc., it resolves to IP 185.199.108.153 and operates under a Let's Encrypt SSL certificate. The domain was created recently and remains active despite multiple detection layers. This combination of GitHub infrastructure, low VT coverage, and active hosting elevates the threat profile significantly.

Current status shows an active threat with elevated risk, as confirmed by multiple security vendors and Safe Browsing. Immediate action is required: block the domain at the network level, avoid interaction, and report to GitHub Trust & Safety. Remaining risk stems from GitHub's permissive hosting environment, which allows rapid deployment of new malicious pages. Users should verify all URLs manually and enable wallet protection features to mitigate crypto drainer attacks.