papon895[.]github[.]io

Papon895.github.io is a recently activated phishing domain designed to harvest user credentials under the guise of a legitimate login portal. This site does not impersonate a specific high-profile brand; instead, it uses a generic landing page to trick victims into entering sensitive information such as usernames, passwords, or even two-factor authentication codes. The threat actor behind this campaign leverages GitHub Pages for hosting, taking advantage of the platform’s trusted reputation to bypass initial detection mechanisms. Given the absence of a branded front and the use of a freely available drainer kit, this appears to be a low-cost, opportunistic credential harvesting operation targeting unsuspecting users across multiple platforms. This domain resolves to IP address 185.199.108.153 and is currently hosted on GitHub, Inc.’s infrastructure. VirusTotal confirms that 11 out of 95 participating security vendors have flagged this domain as malicious, indicating moderate detection across the security community. Papon895.github.io is listed on one active security blocklist and is actively blocked by OpenPhish, a leading phishing intelligence feed. The domain was registered through GitHub Pages, leveraging the platform’s free hosting service to deploy the phishing content. The SSL certificate, issued by Let’s Encrypt, adds a false layer of legitimacy, further increasing the likelihood of user deception. Papon895.github.io remains active as of the latest analysis, with no signs of takedown or deactivation. Despite being flagged by OpenPhish and detected by 11 security vendors, the domain continues to operate and pose a risk to users who may encounter it through phishing emails, social media links, or compromised websites. The ongoing activity suggests that this threat actor is actively refining or reusing infrastructure. Users are strongly advised to avoid interacting with this domain, verify URLs before entering credentials, and report any suspicious activity to their security teams or through dedicated phishing reporting platforms. Remaining risk is assessed as HIGH due to the active status, moderate detection rate, and potential for rapid evolution in tactics. Immediate action is required to prevent credential theft and further propagation of this phishing campaign.