suhana1849[.]github[.]io

Analysis of the domain suhana1849.github.io indicates active phishing infrastructure targeting users through a verification-themed lure. Registered on October 20, 2025, via GitHub, Inc., the domain resolves to 185.199.109.153, a known GitHub Pages hosting IP. The page title, 'Verification,' suggests an attempt to deceive users into submitting credentials or personal data under the guise of a security check. Infrastructure analysis reveals the use of Varnish, GitHub Pages, HSTS, and Fastly, consistent with legitimate hosting but repurposed for malicious activity. The domain is flagged on two security blocklists (PhishDestroy, PhishingDB) and is classified as 'SOCIAL_ENGINEERING' by Google Safe Browsing. A Let's Encrypt SSL certificate is present, providing a false sense of legitimacy. As of July 12, 2026, the domain remains active, with 16 of 95 security vendors on VirusTotal detecting it as malicious. The Gridinsoft trust score of 0/100 further corroborates its high-risk status. No specific brand impersonation or phishing kit details are currently confirmed, limiting attribution beyond the generic 'verification' theme. Defenders should prioritize blocking this domain at the network and endpoint levels, particularly in environments where credential harvesting poses a significant risk. Additional monitoring of GitHub Pages-hosted domains with similar naming patterns (e.g., numeric suffixes) may help identify related threats. The absence of further intelligence on the actor or campaign suggests this is opportunistic rather than part of a targeted operation.