joao-robertoo[.]github[.]io

This domain, joao-robertoo.github.io, is identified as a generic phishing threat with a high-risk classification. Analysis indicates it leverages GitHub Pages infrastructure to host deceptive content, likely targeting users through credential harvesting or malware distribution. No specific brand impersonation or drainer kit association has been confirmed, but the domain exhibits characteristics consistent with opportunistic phishing campaigns. Infrastructure analysis reveals the domain resolves to IP address 185.199.108.153, associated with GitHub, Inc., and uses a Let's Encrypt SSL certificate (R12). VirusTotal detection shows 16 out of 95 security vendors flagging the domain as malicious. The domain is registered through GitHub, Inc., and its page title, 'Site not found · GitHub Pages,' suggests either a placeholder or a cloaking attempt. It appears on two security blocklists, including PhishDestroy and PhishingDB, and is geolocated to the United States. As of the latest assessment, joao-robertoo.github.io remains active, posing an ongoing risk to users. Recommended response actions include blocking the domain at the network perimeter, updating endpoint protection rules to detect associated indicators, and monitoring for connections to 185.199.108.153. Despite its current 'Site not found' status, the domain retains potential for reactivation or redirection to active malicious content. Organizations should treat this domain as untrusted until further verification or takedown occurs.