naser4737[.]github[.]io

PhishDestroy identifies naser4737.github.io as an active crypto drainer kit deployed on GitHub Pages, designed to siphon cryptocurrency from unwitting users who connect wallets to the malicious site. The domain does not impersonate a specific brand but instead leverages a generic crypto-themed interface to deceive victims into authorizing fraudulent transactions. The drainer kit is hosted on GitHub’s infrastructure, which complicates takedown efforts due to GitHub’s abuse handling policies. Technical analysis reveals that the domain serves JavaScript payloads capable of detecting wallet extensions and prompting fake signature requests to drain funds.

This domain resolves to IP address 185.199.108.153 and is secured with a Let’s Encrypt SSL certificate. The domain was registered through GitHub, Inc., utilizing GitHub Pages for hosting. According to VirusTotal, the domain has not been flagged by any of the 95 security engines as of the latest scan. The domain appears on 2 public blocklists and is currently blocked by MetaMask and PhishingDB. The registrar and hosting provider (GitHub) have not yet taken enforcement action, leaving the domain active and accessible to potential victims.

As of this report, the threat status remains active with an under_investigation classification. PhishDestroy has flagged this domain and added it to real-time detection feeds to protect users. The current risk level is elevated due to the domain’s active status and lack of takedown action. Users are strongly advised to verify any interaction with this domain using PhishDestroy’s verification tools before proceeding. The remaining risk is high, as the domain continues to operate and may attract victims through social engineering or phishing campaigns.