race-b[.]github[.]io

This domain, race-b.github.io, is flagged as a credential harvesting phishing site targeting users through deceptive login interfaces. Analysis confirms the domain remains active and continues to pose a high-risk threat to individuals and organizations. No legitimate brand impersonation has been explicitly identified, though the phishing infrastructure mimics common authentication workflows to extract sensitive credentials. Infrastructure analysis reveals the domain was registered through GitHub, Inc. on April 14, 2026, and resolves to the IP address 185.199.108.153, hosted within the United States under GitHub’s infrastructure. The SSL certificate is issued by Let’s Encrypt (R12), a common but not exclusive indicator of malicious activity. Security vendors have detected this domain as malicious, with 18 of 95 VirusTotal engines flagging it for phishing-related behavior. The domain appears on one security blocklist and is actively blocked by enterprise threat protection systems. Google Safe Browsing has also classified this domain as phishing, reinforcing its malicious classification. Current monitoring indicates the domain remains operational, though the GitHub Pages front end displays a 'Site not found' error, suggesting the phishing content may be hosted on a subpath or redirected endpoint. Users and organizations are advised to implement immediate blocking of this domain and its associated IP address within network security controls. Security teams should review logs for connections to 185.199.108.153 and race-b.github.io, particularly those involving credential submission or authentication attempts. Given the domain’s association with GitHub Pages, administrators should enforce strict validation of all GitHub-hosted domains and subdomains within their environments to prevent similar threats from bypassing detection.