sujaltonge384[.]github[.]io

PhishDestroy identifies sujaltonge384.github.io as an active crypto drainer phishing domain designed to steal cryptocurrency wallet credentials or private keys. Visitors are tricked into entering sensitive information under the guise of a legitimate service login, after which funds are drained directly from connected wallets. This domain resolves to IP 185.199.108.153 and has already been flagged by security blocklists including OpenPhish and PhishingDB, with zero detections on VirusTotal as of current scans.

This domain was registered via GitHub, Inc., leveraging the platform’s free hosting to evade traditional takedown efforts. It utilizes a Let’s Encrypt SSL certificate to appear legitimate and has been active since its creation. The combination of unflagged status on major scanning platforms and deployment on a trusted domain host highlights the sophistication of this campaign, which specifically targets users in the cryptocurrency space.

If you have visited this site, immediately disconnect your wallet from the internet and transfer any remaining funds to a newly generated address. Do not re-enter any credentials or approve transactions. Report the incident to PhishDestroy for further analysis and consider revoking any connected wallet permissions through your wallet provider’s interface. Always verify links through trusted sources before entering sensitive information.