raomudassir361[.]github[.]io

Analysis of the domain raomudassir361.github.io indicates it is an active phishing infrastructure hosted on GitHub Pages, flagged by multiple security mechanisms as of July 29, 2026. The domain resolves to IP address 185.199.108.153, a known GitHub Pages hosting endpoint, which aligns with its registration through GitHub, Inc. However, the absence of nameservers (NS_NOT_FOUND) is atypical for legitimate GitHub Pages deployments and suggests potential misconfiguration or deliberate obfuscation. Sixteen of ninety-one security vendors on VirusTotal have detected this domain as malicious, while it also appears on at least one security blocklist, corroborating its elevated risk classification.

No specific brand impersonation or scam category has been confirmed in available intelligence, and the exact content of the site remains unanalyzed. The domain is currently active, with no evidence of takedown or remediation. Defenders are advised to treat this domain as hostile infrastructure and implement blocking at the DNS or network level.

GitHub Pages-hosted phishing is a recurring tactic, often leveraging the platform's free hosting and trusted reputation to evade detection. Organizations should monitor for connections to 185.199.108.153 and review logs for any interaction with raomudassir361.github.io, particularly in environments where GitHub Pages is permitted. Further investigation into the page content and any associated threat actor infrastructure is recommended to determine the precise phishing campaign objectives.