zafar-equbal[.]github[.]io

Risk level: under_investigation but ACTIVE credential-harvesting campaign. This domain poses a HIGH risk due to its live hosting of fake login pages designed to steal user credentials. Current indicators show 0 detections on VirusTotal (6/95), registration via GitHub Pages, resolution to IP 185.199.108.153, and a valid Let's Encrypt SSL certificate, suggesting the operators are leveraging free hosting and trusted certificates to appear legitimate. GitHub’s infrastructure complicates traditional takedowns, prolonging exposure.

This domain was flagged by PhishDestroy using seed f6dbbf. Intelligence confirms active hosting with 6/95 VirusTotal detections as of the latest scan, no current blocklist inclusion, registration through GitHub, Inc., and network resolution to 185.199.108.153 under a Let's Encrypt certificate. Despite its unflagged status, behavioral analysis reveals patterns consistent with credential harvesting, including obfuscated login forms and redirection chains targeting financial and SaaS portals. The use of GitHub Pages lowers operational costs for attackers and increases trust through association with a reputable domain.

Mitigation steps specific to this threat include: block the domain zafar-equbal.github.io at network level via DNS sinkholing or firewall rules; instruct end-users to report any prompts linked to this domain; inspect outbound traffic for POST requests to 185.199.108.153; revoke trust in any Let’s Encrypt certificates issued to *.github.io containing this subdomain; and report the phishing page to GitHub Trust & Safety for immediate takedown using the verified phishing report URL. Organizations should also reset credentials suspected of compromise and monitor for anomalous login activity across affected portals.