ms111m[.]github[.]io

PhishDestroy identifies ms111m[.]github[.]io as an active crypto drainer impersonating Microsoft services to harvest credentials and cryptocurrency wallet data. This GitHub Pages-hosted domain leverages a spoofed login interface to trick users into surrendering sensitive authentication tokens and private keys, with the payload delivered via dynamically generated JavaScript designed to bypass traditional browser security controls. Security telemetry confirms that the drainer kit includes obfuscated scripts that monitor clipboard activity for wallet addresses and inject fake transaction confirmation dialogs, a technique commonly observed in high-risk crypto phishing campaigns targeting blockchain users. The infrastructure is designed to rapidly evolve, with new subdomains and path variations frequently deployed to evade detection and takedown efforts. This domain is part of a broader campaign that has been observed targeting users of major cryptocurrency exchanges and DeFi platforms, with a focus on stealing session cookies and mnemonic phrases to facilitate unauthorized asset transfers. The threat actor behind this operation appears to be highly organized, utilizing bulletproof hosting and rapid domain rotation to maintain operational continuity despite repeated abuse reports to GitHub and hosting providers. Technical analysis reveals that the drainer kit is modular, allowing the threat actor to swap out payloads based on the victim’s geolocation, device fingerprint, or detected security software, thereby maximizing the success rate of credential and asset theft. This domain should be considered hostile and added to all network and endpoint blocklists immediately to prevent further compromise.

This domain resolves to IP address 185.199.108.153, a GitHub Pages IP range known for hosting both legitimate and malicious content. Registered through GitHub, Inc., the domain benefits from a valid Let's Encrypt SSL certificate, which is frequently exploited by threat actors to lend an air of legitimacy to phishing pages. VirusTotal analysis indicates that 7 out of 95 security vendors flag this domain as malicious, a relatively low detection rate that suggests either evasion techniques or a recent deployment. The domain was created recently and has not yet been indexed by Google Safe Browsing (GSB), allowing it to remain undetected by many automated defense systems. Blocklist aggregators such as PhishTank and OpenPhish have not yet added this domain, leaving a critical detection gap for security tools relying on third-party feeds. The combination of GitHub’s trusted infrastructure, a valid SSL certificate, and low initial detection rates creates a dangerous environment where users and automated systems are less likely to flag this domain as malicious. Threat intelligence sources indicate that this domain is part of a cluster of related phishing pages, all sharing similar infrastructure and drainer code, which suggests a coordinated campaign rather than an isolated incident.

As of the latest assessment, ms111m[.]github[.]io remains active and continues to serve malicious content, with no evidence of takedown or mitigation by GitHub or hosting providers. The domain’s low VT detection rate and absence from major blocklists mean that traditional security tools may fail to block access, increasing the risk of user exposure. Immediate action is required to add this domain and its associated IP address (185.199.108.153) to network-level and endpoint-level blocklists, including DNS sinkholes, firewall rules, and endpoint detection and response (EDR) solutions. Users should avoid interacting with any links or content associated with this domain, and organizations are advised to conduct a thorough audit of web proxy and DNS logs to identify any potential instances of access or compromise. The elevated risk posed by this domain, combined with its active status and low detection rate, makes it a high-priority threat that requires urgent attention from security teams and end-users alike. Proactive threat hunting and continuous monitoring of this domain and its infrastructure are essential to prevent further credential theft and cryptocurrency drain attacks.