varunvarunsr05-cp[.]github[.]io

PhishDestroy identifies varunvarunsr05-cp.github.io as an active fake login phishing domain currently distributing a cryptocurrency drainer. The site mimics legitimate login interfaces to harvest credentials and initiate unauthorized transactions. Security teams should treat this as an elevated threat due to its active status and confirmed malicious behavior.

This domain was flagged by 4 of 95 VirusTotal vendors, blocked by Google Safe Browsing under the SOCIAL_ENGINEERING category, and registered through GitHub, Inc. The infrastructure resolves to IP 185.199.111.153 and utilizes a Let's Encrypt SSL certificate to appear legitimate. With 4 security vendors flagging it and no trust scores available, this domain exhibits high-risk characteristics typical of credential harvesting campaigns.

Organizations should immediately block varunvarunsr05-cp.github.io at the network perimeter and warn users against interacting with the domain. Users who may have entered credentials should revoke any session tokens and monitor accounts for suspicious transactions. PhishDestroy users are advised to report this domain to enhance collective threat intelligence.