bercode21[.]github[.]io

PhishDestroy identifies the domain bercode21.github.io as an active PayPal phishing campaign, currently hosting fraudulent login pages designed to harvest user credentials. This domain is actively engaged in credential theft and remains operational despite multiple detection mechanisms. The threat involves the impersonation of PayPal's official services to deceive victims into entering sensitive financial information.

This domain was flagged by PhishingDB and is currently detected by 13 of 95 VirusTotal security vendors, indicating a high-risk threat with a significant failure rate in detection. The domain resolves to IP address 185.199.111.153, registered through GitHub, Inc., and has appeared on 1 security blocklist. Additionally, the SSL certificate issued by Let's Encrypt further legitimizes the facade, increasing the likelihood of successful deception. The domain exhibits low trust scores across security platforms, reinforcing its malicious intent.

As of the latest intelligence, bercode21.github.io remains active and poses a severe risk to unsuspecting users. Immediate action is required to prevent credential theft and financial fraud. Users should avoid interacting with this domain entirely and report any encounters to their respective cybersecurity teams or relevant authorities. Organizations are advised to update firewall rules, DNS blocklists, and endpoint protection systems to block all traffic to and from this domain. Proactive monitoring of network traffic for connections to this IP address or domain is strongly recommended to mitigate potential breaches.