ayushsingh728[.]github[.]io

PhishDestroy identifies ayushsingh728.github.io as an active crypto-drainer phishing domain hosted on GitHub Pages. The lure leverages a spoofed developer profile to deliver malicious JavaScript payloads designed to exfiltrate cryptocurrency wallet credentials. No specific drainer kit family was observed in the available telemetry, but the infrastructure closely mirrors known wallet-stealing campaigns that redirect victims to fake MetaMask or Phantom login pages. This domain resolves to IP 185.199.108.153 via GitHub Inc.’s infrastructure and carries a Let’s Encrypt SSL certificate. Security vendors have flagged it at a ratio of 15 out of 95 on VirusTotal, indicating elevated risk. The site was registered through GitHub’s Pages service, which does not expose a traditional creation timestamp; however, passive DNS and certificate transparency logs suggest recent deployment. Google Safe Browsing (GSB) currently lists the domain as unsafe, and threat intelligence platforms report at least 12 blocklist hits across commercial feeds. As of this advisory, the domain remains active and is actively serving malicious content. Immediate network and endpoint blocks are recommended for ayushsingh728.github.io and its resolving IP. Users should avoid visiting the site and audit any recent wallet-related interactions. Remaining risk is elevated due to GitHub’s permissive hosting environment and the domain’s dynamic reputation profile. Continuous monitoring and YARA rule updates are advised to detect derivative campaigns.