momentum-finance[.]github[.]io

The domain momentum-finance.github.io was a generic phishing site posing as a financial service under the name 'Momentum Finance.' It did not impersonate a known brand or deploy a crypto drainer kit but presented itself as an official platform to harvest user credentials or sensitive information. The site is currently taken offline, reducing immediate risk, though prior visitors may remain vulnerable to follow-up attacks.

Technical analysis shows momentum-finance.github.io was flagged by 1 of 95 VirusTotal security vendors, including ChainPatrol, and appeared on 1 security blocklist (PhishDestroy). The domain was registered through GitHub, Inc., and resolved to the IP address 185.199.111.153, hosted on Fastly’s US-based infrastructure (AS54113). The SSL certificate was issued by Let’s Encrypt (R12), and the observed page title was 'Momentum Finance™ | Official Site.' Technologies detected included Varnish, GitHub Pages, and Fastly, with nameservers ns1.github.com and ns2.github.com. Google Safe Browsing did not flag the domain at the time of assessment.

Users who interacted with momentum-finance.github.io should immediately change any credentials entered on the site, enable two-factor authentication (2FA) on all accounts, and monitor for unauthorized access or fraudulent transactions. Report the phishing domain to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group (APWG) to aid in broader mitigation efforts. If financial or crypto accounts were accessed, contact the respective institutions to secure accounts and review transaction histories.