uvr28[.]github[.]io

This domain, uvr28.github.io, is flagged as a high-risk phishing threat designed to deceive users into disclosing sensitive information or downloading malicious payloads. Despite displaying a 'Site not found' error page typically associated with GitHub Pages, the infrastructure analysis reveals active malicious intent. The site is engineered to impersonate legitimate services, often leveraging social engineering tactics such as fake login portals, fraudulent software updates, or counterfeit payment pages to harvest credentials, financial data, or install malware on victim devices. Analysis indicates this domain is part of a broader phishing campaign, supported by multiple technical indicators. The domain was registered through GitHub, Inc. on April 09, 2026, an unusual future date that may suggest domain spoofing or incorrect metadata. It resolves to the IP address 185.199.108.153, a known GitHub hosting endpoint, yet it is flagged by 17 out of 95 security vendors on VirusTotal, including detections for generic phishing and credential theft. Additionally, the domain appears on one security blocklist and is explicitly marked as phishing by Google Safe Browsing. The SSL certificate, issued by Let's Encrypt (R12), provides encryption but does not validate the legitimacy of the content, a common tactic in phishing operations to appear trustworthy. If you have visited uvr28.github.io or interacted with any content hosted on this domain, immediate action is required to mitigate potential risks. First, disconnect the affected device from the network to prevent further data exfiltration or command-and-control communication. Run a full system scan using updated antivirus or endpoint detection tools to identify and remove any malicious software. Reset credentials for any accounts accessed during the visit, prioritizing email, financial, and administrative accounts, and enable multi-factor authentication where available. Monitor financial statements and account activity for unauthorized transactions. Report the domain to your organization’s security team or relevant authorities to aid in broader threat intelligence efforts. Avoid re-engaging with the domain or any associated links, as phishing sites often employ persistent mechanisms to re-infect devices or redirect users to secondary malicious payloads.