arvind67951[.]github[.]io

PhishDestroy identifies the active fake crypto wallet drainer site arvind67951.github.io operating under an elevated generic phishing threat classification. This domain mimics legitimate wallet interfaces to trick users into connecting malicious wallets and draining crypto funds. No specific brand is mimicked in this campaign, indicating a broad opportunistic targeting of crypto users. The drainer kit deployed on this site is designed to prompt wallet connections, request transaction approvals, and exfiltrate private keys or seed phrases, resulting in immediate fund loss. The infrastructure leverages GitHub Pages for free hosting and Let’s Encrypt certificates to build initial trust, a tactic commonly used to bypass corporate email security gateways and personal spam filters.

This domain was flagged by OpenPhish and appears on one additional security blocklist, demonstrating limited but meaningful detection coverage. The VirusTotal score stands at 14/95 security vendors, indicating partial visibility across the threat intelligence ecosystem. Registered through GitHub, Inc., the domain resolves to IP address 185.199.109.153, part of GitHub’s Pages infrastructure. The domain is relatively new, suggesting recent deployment to evade historical reputation filters. It is not currently flagged by Google Safe Browsing (GSB), increasing the risk of exposure to users relying solely on GSB for protection.

As of the latest analysis, arvind67951.github.io remains active and is actively distributing wallet drainer payloads. Immediate response actions include blocking the domain at DNS and network levels, reporting the domain to GitHub Trust & Safety for abuse takedown, and updating enterprise and personal blocklists with the domain and IP. Despite these measures, the risk remains elevated due to the use of trusted hosting providers and Let’s Encrypt certificates, which can deceive users and security tools alike. Users are strongly advised to avoid clicking links to unknown domains, verify wallet URLs manually via official sources, and use hardware wallets or transaction simulation tools before approving any crypto transactions. The combination of partial detection, recent domain age, and reliance on reputable services underscores the persistent threat this domain poses to the crypto community.