j7806118-pixel[.]github[.]io

This domain, j7806118-pixel.github.io, is identified as a high-risk phishing resource targeting users through GitHub Pages infrastructure. Analysis indicates the site is designed to harvest credentials or facilitate fraudulent transactions, though no specific brand impersonation or drainer kit signature has been confirmed in this instance. The page title, 'Site not found · GitHub Pages,' suggests an attempt to mimic legitimate GitHub error pages, potentially luring victims into a false sense of security before redirecting or presenting malicious content. Infrastructure analysis reveals the domain resolves to the IP address 185.199.108.153, hosted under AS54113 (Fastly, Inc.) in the United States. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites. The domain is registered through GitHub, Inc., leveraging the platform’s free hosting service to evade detection. Detection metrics show 11 out of 95 security vendors on VirusTotal flag the domain as malicious, while Google Safe Browsing explicitly classifies it as phishing. The domain appears on one security blocklist, and additional monitoring tools confirm its active status as of the latest scan. Current status remains active, with no evidence of takedown or mitigation by the hosting provider. The domain’s continued operation poses a persistent risk to users, particularly those unfamiliar with GitHub Pages’ legitimate structure. Response actions should include immediate blacklisting in enterprise security systems, browser-based warnings for end users, and reporting to the hosting provider for suspension. Given the domain’s use of a trusted platform and valid SSL certificate, users are advised to verify URLs carefully and avoid interacting with GitHub Pages domains exhibiting unusual or unexpected behavior, such as redirect chains or unsolicited login prompts.