suniljadhav62002-wq[.]github[.]io

PhishDestroy identifies suniljadhav62002-wq.github.io as a high-risk generic phishing domain currently hosting a crypto drainer kit designed to deceive users into approving malicious token transfers. The infrastructure mimics legitimate GitHub Pages domains using Let’s Encrypt-issued SSL certificates, blending into trusted development ecosystems while executing unauthorized blockchain transactions. No specific brand is being impersonated in this campaign, suggesting opportunistic targeting of crypto-savvy visitors.

This domain resolves to IP 185.199.108.153 and was registered through GitHub, Inc. Google Safe Browsing classifies it under SOCIAL_ENGINEERING, while VirusTotal shows detection coverage at 15 out of 95 security engines. The domain’s creation date is not disclosed in open feeds, though passive DNS records indicate recent activity. With 15 vendors flagging the site and a 955bd2 seed match, it aligns with known crypto-drainer campaigns leveraging GitHub Pages for evasion.

The domain remains active at the time of analysis, with no evidence of takedown. Users should avoid interaction and implement network-level blocks targeting the IP and domain. While current risk is elevated due to active hosting and partial detection coverage, proactive blocking via threat intelligence platforms like PhishDestroy reduces exposure. Remaining risk stems from potential domain recycling or infrastructure shifts to alternate IPs, necessitating continuous monitoring.