ai-egao[.]github[.]io

This domain, ai-egao.github.io, is identified as a generic phishing infrastructure currently active and posing a high-risk threat. Analysis indicates the site is designed to deceive users into disclosing sensitive information, such as login credentials or personal data, under false pretenses. No specific brand impersonation has been confirmed at this time, but the domain exhibits characteristics consistent with credential harvesting or malware distribution campaigns. Infrastructure analysis reveals the domain was created on April 08, 2026, and is registered through GitHub, Inc., leveraging GitHub Pages for hosting. It resolves to the IP address 185.199.108.153, located in the United States and associated with GitHub’s infrastructure. The SSL certificate is issued by Let’s Encrypt (R12), a common choice for both legitimate and malicious sites. The domain is flagged by 15 of 95 security vendors on VirusTotal, and it appears on two security blocklists, including PhishDestroy and PhishingDB. Despite displaying a 'Site not found' GitHub Pages error, historical or intermittent malicious content may still be accessible or served dynamically. Current status confirms the domain remains active, though its visible content does not match its intended malicious purpose. Users and organizations are advised to block access to ai-egao.github.io at the network level and monitor for any attempts to interact with the domain. Security teams should review logs for connections to 185.199.108.153 or related subdomains, as this may indicate compromise. If credentials or sensitive data were entered on this site, immediate password resets and multi-factor authentication enforcement are recommended. Proactive measures, such as domain reputation checks and endpoint protection updates, should be implemented to mitigate similar threats.