edgespot-ua[.]github[.]io

This domain, edgespot-ua.github.io, is flagged as an active credential harvesting phishing site designed to deceive users into submitting sensitive authentication details. Analysis indicates the domain mimics legitimate login portals, likely targeting corporate or personal accounts through social engineering tactics. The infrastructure leverages GitHub Pages hosting, a common evasion technique to blend malicious content with trusted cloud services, increasing the likelihood of bypassing initial security filters. Evidence supporting this assessment includes detection by 13 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly categorizing the domain as phishing. The domain was registered through GitHub, Inc. on April 14, 2026, and currently resolves to the IP address 185.199.108.153, associated with GitHub’s infrastructure in the United States. Despite displaying a 'Site not found' page title, the domain remains active and appears on one security blocklist, indicating ongoing malicious activity. The SSL certificate is issued by Let’s Encrypt (R12), a detail often exploited to lend false legitimacy to phishing pages. Users who have visited edgespot-ua.github.io or entered credentials on any page associated with this domain should immediately revoke and reset compromised passwords, particularly for accounts linked to corporate or financial services. Enable multi-factor authentication where available to mitigate unauthorized access. Network administrators should block the domain and its resolving IP (185.199.108.153) at the firewall or proxy level to prevent further exposure. Monitor endpoint logs for connections to edgespot-ua.github.io or related GitHub Pages subdomains, as these may indicate successful phishing attempts or follow-up malware delivery. Report the domain to relevant security teams for further analysis and takedown coordination.