gethub-tech[.]pages[.]dev

PhishDestroy’s security research team has identified gethub-tech.pages.dev as an active credential-harvesting phishing domain engineered to mimic GitHub’s legitimate Pages service. This fraudulent site employs visually convincing branding, including a spoofed SSL certificate issued by Google Trust Services, to trick users into entering their GitHub credentials. The threat actor behind this domain leverages Cloudflare’s infrastructure to obscure their origin, while hosting the malicious content on Cloudflare’s Pages platform. This operation specifically targets developers and open-source contributors by exploiting trust in GitHub’s ecosystem, aiming to harvest sensitive login credentials for account takeover or further cyberattacks. This domain presents an immediate risk due to its current evasion of detection systems. VirusTotal analysis confirms zero detections across 95 security engines, indicating the site remains unflagged on major threat intelligence platforms as of now. Registered through Cloudflare, Inc., the domain resolves to IP address 188.114.97.3, a known Cloudflare IP range frequently abused for phishing and malware distribution. The absence of widespread blocklisting underscores this domain’s stealth capabilities and the urgency for users to verify site legitimacy before submitting credentials. If you have visited gethub-tech.pages.dev or entered any information on the site, immediately change your GitHub password and enable two-factor authentication (2FA). Review your account for unauthorized access, revoke any suspicious third-party integrations, and scan your device with updated antivirus software. Report the domain to GitHub’s Trust & Safety team and PhishDestroy to help mitigate further abuse. Avoid interacting with untrusted links and always verify the URL’s authenticity via official GitHub domains or trusted sources.