mazinlatheef06-del[.]github[.]io

This domain, mazinlatheef06-del.github.io, is actively engaged in credential theft operations targeting users through deceptive GitHub Pages infrastructure. Analysis indicates the site mimics legitimate GitHub login portals to harvest usernames, passwords, and session tokens, which are subsequently exfiltrated to attacker-controlled endpoints. The threat primarily affects individuals redirected from compromised links or fraudulent communications posing as repository notifications or collaboration requests. Infrastructure analysis reveals the domain was registered through GitHub, Inc. on April 27, 2026, and currently resolves to the IP address 185.199.108.153, associated with GitHub’s content delivery network. Detection metrics confirm its malicious status: 13 of 95 security vendors on VirusTotal flag the domain, while two independent blocklists—PhishDestroy and PhishingDB—have blacklisted it. The SSL certificate, issued by Let’s Encrypt (R12), provides encrypted connections to evade basic network monitoring, though this does not mitigate the underlying threat. Users who have visited mazinlatheef06-del.github.io should immediately revoke any entered credentials, particularly for version control platforms or linked accounts. System logs should be reviewed for unauthorized access, and multi-factor authentication should be enforced on all critical services. Network administrators are advised to block the domain and its resolving IP at the perimeter, while endpoint protection systems should be updated to include this indicator of compromise. The domain remains active as of this advisory, underscoring the need for continued vigilance.