engrmansoor304[.]github[.]io

This domain is flagged as a high-risk credential theft phishing site targeting users through deceptive login portals. Analysis indicates the infrastructure is designed to harvest account credentials, likely for financial fraud or unauthorized account access. The domain’s current status remains active, posing an immediate threat to unsuspecting visitors. Infrastructure analysis reveals the following technical indicators: the domain is hosted on GitHub Pages, resolving to IP address 185.199.108.153, a known GitHub, Inc. endpoint located in the US. The SSL certificate is issued by Let’s Encrypt (R12), a common certificate authority exploited in phishing campaigns. The domain was registered on April 25, 2026, though the creation date may reflect GitHub’s automated provisioning rather than traditional registration. Security vendors on VirusTotal flag this domain at 6/95, indicating moderate detection but sufficient confirmation of malicious intent. The domain appears on one security blocklist, specifically PhishDestroy, further validating its classification as a phishing threat. The page title, 'Site not found · GitHub Pages,' suggests either a placeholder or a deliberate attempt to evade detection while maintaining operational infrastructure. Mitigation steps for credential theft phishing include immediate blocking of the domain at the network level via DNS or firewall rules. Users who may have interacted with this domain should reset passwords for any accounts accessed during the exposure window, prioritizing accounts with financial or sensitive data. Multi-factor authentication (MFA) should be enforced on all critical accounts to mitigate unauthorized access risks. Security teams are advised to monitor logs for connections to 185.199.108.153 or related GitHub Pages subdomains, as these may indicate compromise. If the domain was accessed via a corporate or personal device, a full security scan is recommended to detect potential malware or credential-stealing payloads. Organizations should also review GitHub Pages usage policies to prevent abuse of legitimate hosting services for phishing operations.