24eg105p46-dotcom[.]github[.]io

This domain, 24eg105p46-dotcom.github.io, is flagged as a high-risk phishing infrastructure designed to harvest GitHub credentials. Analysis indicates the threat falls under the SOCIAL_ENGINEERING category, a tactic commonly used to deceive users into disclosing sensitive login information. While no specific drainer kit has been identified, the domain leverages GitHub Pages hosting to lend an air of legitimacy, increasing the likelihood of successful deception. Infrastructure analysis reveals the following technical indicators: the domain currently resolves to IP address 185.199.108.153, a known GitHub Pages endpoint. It is registered through GitHub, Inc., and utilizes a Let's Encrypt SSL certificate, which may falsely reassure users of its authenticity. VirusTotal reports 0/95 detections, indicating the domain has not yet been widely flagged by security vendors. Google Safe Browsing explicitly classifies this domain under SOCIAL_ENGINEERING, and no blocklist entries have been recorded at this time. The domain's creation date remains undisclosed, but its active status suggests recent deployment. The domain remains active as of the latest assessment, posing an ongoing risk to users. While no takedown actions have been observed, the use of GitHub Pages hosting complicates mitigation efforts, as the platform is not inherently malicious. Organizations are advised to block the domain at the network level and monitor for credential reuse attempts. Users should be educated on recognizing SOCIAL_ENGINEERING tactics, particularly those impersonating legitimate services. Despite the lack of detections, the domain's high-risk classification and active status warrant immediate defensive measures.