mubeenahmedyt789-dotcom[.]github[.]io

This domain, mubeenahmedyt789-dotcom.github.io, is identified as part of a credential theft operation targeting users through deceptive login portals. Analysis indicates the infrastructure is designed to mimic legitimate authentication pages, tricking visitors into submitting sensitive account details such as usernames, passwords, and multi-factor authentication codes. The domain leverages GitHub Pages hosting to evade detection, a tactic increasingly observed in phishing campaigns due to its low cost and perceived legitimacy. While the current page title displays 'Site not found · GitHub Pages,' this is likely a temporary state or a cloaking technique to avoid automated security scans. Evidence supporting this assessment includes detection by 1 of 95 security vendors on VirusTotal, a low but notable signal given the domain's use of a reputable hosting provider. Infrastructure analysis reveals the domain resolves to IP address 185.199.108.153, registered under GitHub, Inc., and secured with a Let's Encrypt SSL certificate (R12). The domain appears on one security blocklist, specifically PhishDestroy, and remains active as of the latest verification. No historical registration data is available through standard WHOIS channels, as GitHub Pages domains are dynamically generated and lack traditional ownership records. Users who have visited mubeenahmedyt789-dotcom.github.io should assume their credentials may have been compromised. Immediate actions include resetting passwords for any accounts accessed after visiting the domain, enabling multi-factor authentication where available, and monitoring linked accounts for unauthorized activity. Browser data should be reviewed for saved credentials associated with the domain, and any cached login sessions should be terminated. Organizations are advised to block the domain and its resolving IP (185.199.108.153) at the network level to prevent further exposure. If financial or sensitive data was entered, affected parties should report the incident to relevant authorities and consider credit monitoring services.