jonsnation[.]github[.]io

PhishDestroy identifies jonsnation.github.io as an active phishing domain specializing in a generic phishing threat categorized as a crypto drainer. The site does not impersonate a specific brand but is designed to illicitly extract cryptocurrency credentials or assets from unsuspecting victims. There is no indication of a known drainer kit, but the domain's use of GitHub Pages allows it to appear legitimate while hosting malicious content.

Technical indicators reveal that jonsnation.github.io has a VirusTotal detection rate of 16 out of 95 security vendors flagging it as malicious. The domain is registered through GitHub, Inc., and resolves to IP address 185.199.108.153. It is protected by an SSL certificate issued by Let's Encrypt, which may lend a false sense of security to users. The domain appears on two separate security blocklists, including OpenPhish and PhishingDB. Google Safe Browsing categorizes the domain under 'SOCIAL_ENGINEERING,' highlighting its use in tricking users. These data points collectively confirm the domain's high-risk status.

Currently, jonsnation.github.io remains active and continues to pose a significant threat to users, especially those involved in cryptocurrency transactions. Security platforms have blocked it, but users should remain cautious and avoid interacting with any content hosted on this domain. PhishDestroy recommends that individuals verify the domain status before engaging with it and maintain updated security software to mitigate risk. Immediate reporting of any suspicious activity related to this domain can help reduce potential damage and protect the community at large.