almasalsufi[.]github[.]io

The domain almasalsufi.github.io is assessed as a high-risk credential theft phishing site. Analysis indicates that this domain is actively being used to trick users into divulging sensitive information, such as login credentials, which can be used for unauthorized access to accounts and systems.

Infrastructure analysis reveals that almasalsufi.github.io was created on March 26, 2026, and is registered through GitHub, Inc. The domain resolves to the IP address 185.199.108.153, which is located in the United States and is associated with GitHub, Inc. According to VirusTotal, 16 out of 95 security vendors flag this domain as malicious, indicating a significant level of suspicion among security experts. The domain also appears on one security blocklist, further corroborating its malicious nature. The SSL certificate is issued by Let's Encrypt / R12, which is common for both legitimate and phishing sites, but does not inherently provide security.

To mitigate the risk of credential theft, users should avoid clicking on links or entering any personal information on almasalsufi.github.io. Organizations should update their security policies to include blocking this domain and educate employees about the signs of phishing attacks. Network administrators should consider implementing DNS filtering and web content filtering solutions to prevent access to this domain. Regularly monitoring user accounts and credentials for any unauthorized activity is also recommended. Additionally, users should enable two-factor authentication (2FA) on all critical accounts to add an extra layer of security.