mahyar-bandegie82[.]github[.]io

PhishDestroy identifies the domain mahyar-bandegie82.github.io as part of an active generic phishing campaign. The threat involves a deceptive login portal designed to harvest user credentials under false pretenses. This domain is currently engaged in malicious activities and remains unmitigated by primary hosting platforms. PhishDestroy confirms mahyar-bandegie82.github.io is flagged by 16 of 95 VirusTotal security vendors, indicating substantial but not universal detection consensus. The domain is registered through GitHub, Inc., resolves to IP 185.199.108.153, and appears on 1 security blocklist. The SSL certificate is issued by Let's Encrypt, suggesting an attempt to mimic legitimate web services. PhishDestroy notes this domain was created with the intent to deceive, leveraging GitHub’s trusted infrastructure to lower user suspicion and bypass basic security filters. Risk assessment for mahyar-bandegie82.github.io is elevated due to its active campaign and partial detection by security vendors. The use of GitHub infrastructure and a valid SSL certificate increases the likelihood of successful deception. PhishDestroy advises immediate blacklisting of this domain and IP address 185.199.108.153 in organizational security systems. Users should avoid interacting with this domain and report any observed phishing attempts. Security teams are urged to monitor for related domains or infrastructure that may emerge as this campaign evolves. Full behavioral analysis and indicators of compromise are available in the PhishDestroy threat intelligence feed under seed b6110a.