poki8ju7[.]github[.]io

PhishDestroy identifies poki8ju7.github.io as an active generic phishing domain associated with credential harvesting campaigns. This domain poses a high-risk threat to users through social engineering tactics designed to deceive victims into divulging sensitive login information under false pretenses. While no specific brand or drainer kit attribution was observed in available intelligence, the domain’s infrastructure aligns with common phishing operations observed in recent threat landscapes.

This domain exhibits multiple red flags across key technical indicators. It is flagged by Google Safe Browsing under the SOCIAL_ENGINEERING category, indicating malicious intent to mislead users. The domain resolves to IP address 185.199.108.153 and is hosted via GitHub Pages, leveraging the GitHub, Inc. registrar. A VirusTotal analysis reveals a 14 out of 95 security vendor detection score, with 14 vendors identifying it as malicious. Additionally, this domain is currently blocked by PhishingDB and appears on one confirmed security blocklist, underscoring its malicious reputation.

The domain poki8ju7.github.io remains active as of the latest assessment, with immediate response actions recommended for end-users and organizations. GitHub should be notified to suspend the associated Pages site hosting this content. Network defenders are advised to block the domain at DNS and perimeter levels and correlate network traffic with the known IP (185.199.108.153). Users should avoid all interaction, including clicking or submitting data, due to the high risk of credential theft or malware delivery. Remaining risk is assessed as high given confirmed malicious classification and active hosting environment. Continuous monitoring and proactive threat hunting are strongly encouraged to mitigate potential downstream compromise.