michealbolaji024-web[.]github[.]io

This domain, michealbolaji024-web.github.io, is an active phishing site designed to steal user credentials by mimicking legitimate GitHub login interfaces. Visitors are presented with a fraudulent page that closely resembles GitHub's authentication portal, where entered usernames and passwords are captured by threat actors. The site may also attempt to distribute malware or request additional sensitive information under false pretenses, posing a significant risk to both individual users and organizational security. Analysis indicates the domain is hosted on GitHub's infrastructure, resolving to the IP address 185.199.108.153, which is associated with GitHub Pages. The domain was registered through GitHub, Inc., and remains active as of this report. VirusTotal detection metrics show that 13 out of 95 security vendors have flagged this domain as malicious, a clear indicator of its phishing intent. The site employs a Let's Encrypt SSL certificate, which, while providing encryption, does not validate the legitimacy of the content or the entity behind it. If you or someone in your organization has visited michealbolaji024-web.github.io and entered credentials or downloaded files, immediate action is required. First, disconnect the affected device from the network to prevent potential lateral movement or data exfiltration. Next, reset all passwords entered on the site, prioritizing accounts with elevated privileges or access to sensitive systems. Enable multi-factor authentication wherever possible to add an additional layer of security. Scan the device using updated security tools to detect and remove any malware that may have been installed. Finally, monitor accounts for unusual activity and report the incident to your organization's security team or a trusted security provider for further analysis and remediation.