shahmeerkhan0724-netizen[.]github[.]io

This domain is an active phishing infrastructure designed to harvest login credentials by impersonating Netizen authentication portals. Users who visit the site are presented with a fraudulent login interface that closely mimics legitimate Netizen services, tricking them into entering sensitive account details. The domain is hosted on GitHub Pages, a common tactic used to exploit trusted platforms for malicious purposes. Analysis indicates the domain resolves to 185.199.110.153, an IP address assigned to Fastly, Inc. (AS54113) in the United States. The site is flagged by 7 out of 95 security vendors on VirusTotal, confirming its malicious intent. It is registered through GitHub, Inc., and uses a Let's Encrypt SSL certificate (YR2), which provides a false sense of security to potential victims. The domain appears on one security blocklist and is actively blocked by PhishDestroy, further validating its threat status. If you or someone in your organization has visited shahmeerkhan0724-netizen.github.io, immediate action is required. First, do not enter any credentials or personal information on the site. If credentials were already submitted, reset passwords for all accounts accessed from the same device, especially those linked to Netizen services. Enable multi-factor authentication where available to add an additional layer of security. Scan the device for malware using updated security tools, as phishing sites may deploy additional payloads. Report the incident to your organization’s security team or relevant authorities to assist in tracking and mitigating the threat. Monitor accounts for unusual activity, such as unauthorized logins or transactions, and consider freezing credit if financial information was exposed.