mail-proton-me[.]github[.]io

PhishDestroy has identified mail-proton-me.github.io as a high-risk generic phishing threat. This domain is currently active and has been flagged by 16 out of 95 security vendors on VirusTotal, indicating widespread recognition as malicious. The site impersonates Proton Mail to harvest login credentials, posing a significant risk to users who may unknowingly enter sensitive information.

The domain was created on April 8, 2026, and is registered through GitHub, Inc., resolving to IP address 185.199.111.153. It uses an SSL certificate issued by Let's Encrypt (R12), which provides a false sense of security. Google Safe Browsing flags it for phishing, and it appears on one security blocklist. The page title displayed is "Site not found · GitHub Pages," which may be a placeholder or the actual phishing page is not currently loading; however, the domain remains active and could be serving malicious content intermittently.

Users who encounter this domain should avoid visiting it entirely and never enter any personal information. If credentials were already submitted, they should change their Proton Mail password immediately and enable two-factor authentication. PhishDestroy recommends blocking this domain at the network level and reporting it to GitHub via their abuse reporting mechanism. Additionally, monitor accounts for unauthorized access and consider using a password manager to avoid reusing passwords across services.