zhta2873-lang[.]github[.]io

This domain is flagged as a high-risk credential harvesting operation impersonating the WhatsApp messaging platform. Analysis indicates the threat type is a generic phishing scheme designed to capture user login credentials through a fraudulent interface mimicking the legitimate service. The campaign targets unsuspecting users by presenting a seemingly authentic login portal, increasing the likelihood of successful credential theft. Infrastructure analysis reveals the domain zhta2873-lang.github.io is hosted on GitHub Pages infrastructure, resolving to the IP address 185.199.111.153, located in the United States under AS54113 (Fastly, Inc.). The SSL certificate is issued by Let's Encrypt (R12), a common practice among both legitimate and malicious sites to establish encrypted connections. Detection metrics show 10 out of 95 security vendors on VirusTotal have flagged this domain as malicious, while it appears on at least one security blocklist. The page title explicitly references WhatsApp, reinforcing the impersonation tactic. No historical registration data is available due to the domain being a GitHub Pages subdomain, which limits visibility into creation timelines. Mitigation against this credential harvesting threat requires multi-layered defenses. Users should verify the legitimacy of login pages by inspecting the URL for anomalies, such as unexpected subdomains or misspellings. Organizations are advised to implement domain-based blocking for zhta2873-lang.github.io and monitor for connections to 185.199.111.153 in network logs. Security teams should prioritize user education on recognizing phishing indicators, such as mismatched SSL certificates or suspicious page titles. Enforcing multi-factor authentication (MFA) for all accounts can significantly reduce the impact of stolen credentials. Additionally, endpoint protection solutions should be configured to detect and block access to known malicious domains, leveraging threat intelligence feeds that include this domain and associated indicators.