ahmed-qureshi-dev[.]github[.]io

The domain ahmed-qureshi-dev.github.io is actively hosting a generic phishing page designed to mimic legitimate GitHub Pages infrastructure. Analysis indicates the threat type is not tied to a specific brand impersonation but rather a broad credential harvesting or malicious redirection scheme. The domain remains operational as of the latest verification, posing a high risk to users who may encounter it through phishing links or compromised referrals. Technical indicators reveal the domain was created on May 04, 2026, and is registered through GitHub, Inc., leveraging the platform’s hosting services. It resolves to the IP address 185.199.108.153, associated with GitHub’s infrastructure in the United States. Security vendor analysis shows 14 of 95 engines on VirusTotal flag the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Let’s Encrypt (R12), a common but not inherently trustworthy certificate authority often exploited in phishing campaigns. The page title, 'Site not found · GitHub Pages,' suggests an attempt to deceive users into believing the absence of content is legitimate, potentially masking hidden malicious activity or preparing for future exploitation. Current status confirms the domain remains active, with no takedown or mitigation measures observed. Organizations and users are advised to block the domain at the network level and monitor for connections to 185.199.108.153. Security teams should investigate logs for prior interactions with this domain and assess potential credential exposure. End-users should be trained to recognize GitHub Pages impersonation tactics, particularly those leveraging subdomains of github.io. If encountered, users should avoid interaction, report the domain to their security provider, and reset credentials if any login attempts were made.