rafael-ods[.]github[.]io

PhishDestroy identifies rafael-ods.github.io as an active credential harvesting phishing domain with an elevated risk level. This threat specifically targets users by attempting to steal login credentials, posing significant risks to personal and organizational security.

This domain resolves to IP address 185.199.108.153 and is registered through GitHub, Inc., utilizing a Let's Encrypt SSL certificate. VirusTotal reports that 14 out of 95 security vendors have flagged this domain as malicious. It appears on one security blocklist and is blocked by OpenPhish, indicating recognized malicious activity. These indicators collectively suggest a high likelihood that the domain is being used for phishing purposes.

To mitigate risks from this credential harvesting threat, users and organizations should avoid interacting with content hosted on rafael-ods.github.io. Implementing email filtering to block messages containing this domain, enforcing multi-factor authentication on sensitive accounts, and regularly updating endpoint protection are recommended. Security teams should monitor blocklists and update detection rules to prevent credential compromise associated with this domain.