chetan980[.]github[.]io

PhishDestroy identifies chetan980.github.io as an active generic phishing domain deployed under GitHub Pages, leveraging a crypto drainer kit designed to siphon cryptocurrency assets from unwitting victims. The site masquerades as a legitimate service, likely targeting users through social engineering or malvertising campaigns. No specific brand is being impersonated in this iteration; instead, it operates as a standalone fraudulent platform. The infrastructure relies on a GitHub repository (chetan980.github.io) to host malicious JavaScript payloads capable of draining wallet funds upon interaction. Genesis date places this domain within recent fraud campaigns, suggesting an opportunistic deployment rather than a long-standing operation.

This domain was flagged by PhishDestroy with the following technical indicators: VirusTotal detection score of 6/95, indicating zero antivirus engines have flagged it at the time of analysis; registered through GitHub, Inc., resolving to IP 185.199.108.153; secured with a Let’s Encrypt SSL certificate to appear legitimate. Google Safe Browsing (GSB) has not yet categorized this domain, and current blocklist aggregations show no prior listings. The absence of detections aligns with the domain’s recent activation and the use of GitHub’s benign infrastructure, which is frequently abused by threat actors to host phishing and malware due to its trusted reputation.

As of current assessment, chetan980.github.io remains active and under investigation with status labeled as 'active' and seed ID 093884. Immediate response actions include domain takedown requests submitted to GitHub, coordination with abuse teams, and continuous monitoring for payload evolution. Though the current risk is assessed as 'under_investigation', the operational deployment of a crypto drainer kit poses a high imminent threat to cryptocurrency users. Users are strongly advised to avoid visiting this domain, disable JavaScript on untrusted sites, verify URLs before interaction, and report any encountered fraudulent activity. Remaining risk factors include the potential for rapid domain rotation, payload updates, or expansion into brand impersonation. Organizations and individuals are urged to deploy browser-based network filtering, monitor wallet transaction alerts, and maintain updated threat intelligence feeds to mitigate exposure.