gabrieltinoco01[.]github[.]io

This domain, gabrieltinoco01.github.io, is flagged as a high-risk credential harvesting phishing resource. Analysis indicates the site is actively engaged in collecting sensitive authentication details, including usernames, passwords, and potentially multi-factor authentication codes, under the guise of legitimate services. The infrastructure leverages GitHub Pages hosting, which provides a veneer of legitimacy while facilitating malicious activity. Given the high-risk classification, this domain poses a significant threat to both individual and organizational security, particularly for users who may be deceived by its GitHub-hosted appearance. Infrastructure analysis reveals the domain is registered through GitHub, Inc. and resolves to the IP address 185.199.108.153, located in the United States. The SSL certificate is issued by Let's Encrypt (R12), a common practice among both legitimate and malicious sites to enable HTTPS connections. The domain was created on March 31, 2026, an anomalous future date that suggests potential manipulation or misconfiguration, further raising suspicion. As of the latest assessment, the domain appears on one security blocklist and is flagged by 15 out of 95 security vendors on VirusTotal, with detection engines specifically identifying it as a phishing resource. The page title, 'Site not found · GitHub Pages,' may be an attempt to mislead automated detection systems or users into believing the site is inactive, while underlying malicious scripts or redirects remain operational. Mitigation against credential harvesting phishing domains such as this requires a multi-layered approach. Organizations should implement strict domain and URL filtering policies to block known malicious hosts, including those leveraging legitimate hosting services like GitHub Pages. Endpoint protection solutions should be configured to detect and prevent access to domains flagged by multiple security engines, particularly those with anomalous creation dates or low trust scores. User awareness training is critical, emphasizing the risks of entering credentials on any site, even those hosted on seemingly trustworthy platforms. Additionally, enabling multi-factor authentication (MFA) across all accounts can significantly reduce the impact of credential theft, as stolen passwords alone may be insufficient for unauthorized access. Network monitoring for connections to known malicious IPs, such as 185.199.108.153, should be enforced to detect and respond to potential compromises.