andresrincon45030-del[.]github[.]io

This domain, andresrincon45030-del.github.io, is actively engaged in a high-risk phishing campaign impersonating Facebook, a well-known social media platform. The page title explicitly displays 'Facebook,' indicating an attempt to deceive users into believing they are interacting with the legitimate service. Analysis confirms the domain remains operational, posing a direct threat to users who may unknowingly submit credentials or personal information. Infrastructure analysis reveals the domain is hosted on GitHub Pages infrastructure, registered through GitHub, Inc. It resolves to the IP address 185.199.111.153, associated with AS54113 (Fastly, Inc.) in the United States. The SSL certificate is issued by Let's Encrypt (R12), a common but not inherently malicious certificate authority. Detection metrics indicate the domain is flagged by 12 of 95 security vendors on VirusTotal, while only one security blocklist currently includes it. The low blocklist prevalence suggests either recent activation or evasion of broader detection mechanisms. The domain remains active as of this analysis, with no indication of takedown or mitigation. Users are advised to exercise extreme caution when encountering this domain or any unsolicited communications directing them to it. Organizations should update web filtering rules to block access to andresrincon45030-del.github.io and monitor for related indicators of compromise, including the IP address 185.199.111.153 and associated GitHub Pages subdomains. Security teams are encouraged to correlate this activity with other Facebook-themed phishing campaigns to identify potential larger-scale operations.