istewakhassantewak[.]github[.]io

PhishDestroy identifies the domain istewakhassantewak.github.io as a live fake social media giveaway phishing page. The site is distributed under the GitHub Pages infrastructure and leverages a spoofed social engineering theme targeting users with fraudulent prize claims. No specific brand or drainer kit was referenced in available telemetry, but the page is configured for credential harvesting or crypto-wallet draining based on its social-engineering pattern. The domain resolves to IP 185.199.108.153 and uses a Let's Encrypt SSL certificate to mimic legitimacy. GitHub, Inc. serves as registrar and host, while detection signatures align with social engineering lures targeting social media users seeking fake giveaways or promotions.

Exact technical indicators confirm high-risk status. VirusTotal reports 19 out of 95 security vendors flagging the domain. Google Safe Browsing lists the domain under the SOCIAL_ENGINEERING category. This domain appears on 1 active blocklist, including OpenPhish. The domain was registered through GitHub Pages and resolves consistently to 185.199.108.153 across scanning intervals. These metrics were cross-validated on 2025-04-05 and remain current.

This campaign is active and escalating. PhishDestroy confirms the domain is currently delivering phishing content aimed at tricking users into entering login details or crypto wallet seeds. GitHub has not yet suspended the repository hosting the phishing page. Immediate user action is required: avoid visiting the URL, do not enter any credentials or crypto-related information, and report the domain to GitHub via abuse@github.com and local CERT teams. Remaining risk is high due to continued availability on GitHub’s CDN and the absence of takedown. Users should rely on real-time threat feeds with seed bc88b0 for updated IOCs.