syedaumemasooma[.]github[.]io

The domain syedaumemasooma.github.io is hosted on GitHub Pages and resolves to the IP address 185.199.108.153, which is part of GitHub's content‑delivery infrastructure. Registration information shows the domain was created through GitHub, Inc., indicating that the attacker leveraged a legitimate service to obtain a trusted TLS certificate automatically provisioned for the subdomain. VirusTotal has recorded detections from 12 of 91 scanning engines, confirming that multiple security products classify the site as malicious.

The domain is presently listed on two public phishing blocklists and is actively blocked by PhishDestroy and OpenPhish, demonstrating that several community‑driven feeds have already incorporated it. Nameserver lookup returned no results (NS_NOT_FOUND), which is typical for GitHub‑hosted pages that rely on GitHub’s internal DNS configuration. The available data does not include a page title, SSL certificate details beyond the default GitHub issuance, or any observed HTTP response codes, leaving the exact content of the site unverified.

Because the infrastructure uses a reputable hosting provider, the domain can be difficult to take down without a valid legal request to GitHub, and the automated certificate issuance further masks malicious intent. Defenders should continue to block the domain at the network perimeter, update URL filtering feeds with the observed IP and domain, and monitor for any new indicators that may appear in traffic logs. Incident responders should also consider submitting the URL to additional analysis services to enrich the current evidence set and to verify whether the site is serving credential‑stealing forms or other payloads.