arhumnasir[.]github[.]io

This domain, arhumnasir.github.io, is flagged as an active generic phishing site hosted on GitHub Pages infrastructure. Analysis indicates it resolves to IP 185.199.108.153, a GitHub-operated address, which aligns with its registration through GitHub Pages. As of July 29, 2026, the domain appears on one security blocklist and is blocked by PhishDestroy.

VirusTotal reports 10 of 91 security vendors detecting malicious activity associated with this domain, though the specific nature of the threat—such as the targeted brand or phishing kit—remains unconfirmed due to limited technical details in available intelligence. The exact content of the site has not been analyzed, so defenders should not assume a specific impersonation (e.g., corporate login, financial service, or social media) without further evidence. The domain's hosting on GitHub Pages may complicate takedown efforts, as it leverages legitimate infrastructure.

Defenders are advised to treat this domain as elevated risk and implement blocking at the network level, particularly for endpoints where credential harvesting could lead to lateral movement or data exfiltration. Additional investigation into HTTP response headers, SSL certificate details, and any redirects is recommended to determine the full scope of the threat. If internal telemetry shows user interaction with this domain, initiate credential reset protocols and review logs for signs of successful phishing attempts.