siqmnslxng[.]github[.]io

This domain, siqmnslxng.github.io, poses a high-risk credential-theft threat by impersonating PayPal’s login portal. Visitors are presented with a fraudulent page titled 'Log in to your PayPal account,' designed to capture sensitive financial credentials, including usernames, passwords, and potentially two-factor authentication codes. The site mimics legitimate PayPal branding, increasing the likelihood of successful deception, particularly among users expecting routine account verification requests. Such stolen credentials are frequently exploited for unauthorized transactions, identity theft, or sold on underground markets for further criminal activity. Analysis indicates the domain is hosted on GitHub’s infrastructure, resolving to the IP address 185.199.108.153, which is associated with AS54113 (Fastly, Inc.) in the United States. The SSL certificate is issued by Let’s Encrypt (R12), a common tactic to lend an appearance of legitimacy. Detection data from VirusTotal reveals that 10 out of 95 security vendors have flagged this domain as malicious, while it also appears on at least one security blocklist. The domain remains active as of this report, with no evidence of takedown or mitigation efforts. The use of GitHub Pages for hosting further complicates attribution and enforcement due to the platform’s decentralized nature. Individuals who have visited siqmnslxng.github.io and entered credentials should assume their information has been compromised. Immediate steps include changing the password for the affected PayPal account and enabling multi-factor authentication if not already active. Users should also review recent account activity for unauthorized transactions and report any suspicious charges to their financial institution. Additionally, monitoring for signs of identity theft, such as unexpected credit inquiries or unfamiliar accounts, is recommended. If personal or financial data was entered, consider placing a fraud alert or credit freeze with major credit bureaus to mitigate potential downstream risks.