Is jeona36.github.io a Credential Theft Scam?

The domain jeona36.github.io is currently active and identified as a credential theft phishing operation. Analysis indicates the infrastructure is designed to harvest user login credentials, likely targeting unsuspecting victims through deceptive login portals. The domain remains accessible despite its malicious intent, posing a high risk to users who may encounter it through phishing links or redirects. Infrastructure analysis reveals the domain is flagged by 12 of 95 security vendors on VirusTotal, indicating widespread detection. It resolves to the IP address 185.199.109.153, hosted by GitHub, Inc., and appears on at least one security blocklist. The SSL certificate is issued by Let’s Encrypt (R12), a common choice for both legitimate and malicious sites. The domain was registered through GitHub, Inc., with a creation date of May 16, 2026, which may suggest an attempt to appear legitimate or exploit misconfigured records. The page currently displays a 'Site not found' message, though this could be a temporary state or a cloaking technique to evade detection. As of the latest verification, jeona36.github.io remains active and should be treated as a confirmed threat. Users are advised to avoid interacting with the domain, block it at the network level, and report any phishing attempts to their security teams. Organizations should update their web filters to include this domain and monitor for related indicators of compromise, such as the associated IP address. If credentials were previously entered on this site, immediate password resets and multi-factor authentication enforcement are recommended for all affected accounts.