letarthuralcantara[.]github[.]io

PhishDestroy identifies letarthuralcantara.github.io as hosting a generic phishing page designed to harvest user credentials. The page does not specifically impersonate a named brand but instead employs a generic harvest-and-drain approach to capture any entered credentials. No crypto drainer kit or advanced JavaScript obfuscation was detected during sandbox analysis; the threat is presently a standard credential phishing campaign. This domain was flagged by 14 out of 95 VirusTotal security vendors and is currently resolving to IP address 185.199.108.153. The domain is registered through GitHub Pages, enjoys a valid Let’s Encrypt SSL certificate, and is blocked by the OpenPhish feed. It appears on one public blocklist and carries an elevated risk profile due to the active credential harvesting campaign. As of today, letarthuralcantara.github.io remains active and accessible. GitHub has not yet suspended the page despite the OpenPhish block and low blocklist count. Users should avoid interacting with the site; if credentials were entered, rotate passwords immediately and enable multi-factor authentication. The residual risk remains elevated while the page remains live and the domain continues to resolve.