cerdeirahugo139-alt[.]github[.]io

This domain, cerdeirahugo139-alt.github.io, is confirmed to host a credential harvesting phishing site targeting users of Orange Eysines MP under the guise of "Gestion des Stocks" (Stock Management). The site is designed to deceive visitors into submitting sensitive login credentials, likely for corporate or personal accounts associated with the legitimate Orange Eysines service. Analysis indicates the phishing page employs social engineering tactics, presenting a fabricated login interface that closely resembles the authentic Orange Eysines portal, thereby increasing the likelihood of successful credential theft. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain is flagged by 5 out of 95 security vendors on VirusTotal, a notable detection rate for a recently deployed phishing site. It is hosted on GitHub Pages infrastructure, resolving to the IP address 185.199.111.153, which is part of AS54113 (Fastly, Inc.) located in the United States. The domain appears on one security blocklist, and its SSL certificate is issued by Let's Encrypt (R12), a common choice for threat actors due to its free and automated issuance process. The page title, "Orange Eysines MP — Gestion des Stocks," directly references the targeted entity, further corroborating the phishing intent. Users who have visited cerdeirahugo139-alt.github.io or interacted with its content should take immediate remedial actions. First, any credentials entered on the site must be considered compromised and should be changed immediately across all platforms where they were reused. System administrators should monitor for unauthorized access attempts or anomalous login activity, particularly for accounts associated with Orange Eysines or related services. Additionally, users should verify the legitimacy of any unexpected communications or login prompts by directly accessing the official Orange Eysines portal through verified channels. Organizations are advised to block the domain and its resolving IP at the network perimeter to prevent further exposure.