waseem-kanhio[.]github[.]io

Analysis Date: July 29 2026. The domain waseem-kanhio.github.io is hosted on GitHub Pages and resolves to the IP address 185.199.110.153, which belongs to the GitHub infrastructure. The domain has been flagged by the PhishDestroy blocklist and is listed on one additional public security blocklist. VirusTotal reports that 16 of 91 scanned scanners have generated a detection for the domain, indicating a non‑trivial level of malicious activity.

The domain is categorized as a generic phishing site with an elevated risk rating and its current status is active. Infrastructure analysis shows that the use of GitHub Pages provides a legitimate TLS certificate issued to *.github.io, which can give the site a superficial appearance of trustworthiness. However, the presence of detections on multiple AV engines and inclusion on a dedicated phishing blocklist suggest that the content is being used for credential harvesting or other fraudulent purposes. The limited visibility into the actual page content means that the precise target brand or login workflow cannot be confirmed at this time.

Defenders should consider adding the domain to local deny lists and ensure that outbound connections to 185.199.110.153 are monitored for suspicious HTTP traffic originating from internal users. Email filtering solutions should be updated to block URLs referencing this domain, and endpoint protection products should be configured to respect the VirusTotal detection score. Because the domain is served from a widely trusted CDN, traditional URL reputation checks may be insufficient; continuous monitoring of threat intelligence feeds for new indicators related to this domain is recommended. Organizations that employ web proxy or secure web gateway solutions should enforce policy blocks for the domain to mitigate potential credential theft attempts.