luqmanwazir69[.]github[.]io

PhishDestroy identifies luqmanwazir69.github.io as a high-risk credential theft domain currently active in phishing campaigns targeting unsuspecting users. The infrastructure exhibits classic phishing characteristics including domain mimicry and HTTPS encryption to establish false legitimacy. This domain was flagged by OpenPhish and removed from active circulation in several security blocklists, though the underlying GitHub-hosted content remains accessible and potentially harmful.

This domain resolves to IP 185.199.108.153 and was registered through GitHub, Inc. Security vendor analysis reveals a detection rate of 14 out of 95 scanners identifying malicious payloads associated with this infrastructure. The Let’s Encrypt SSL certificate further enhances the domain’s perceived trustworthiness, potentially luring victims into entering credentials on spoofed login portals. Despite appearing on a single security blocklist, the combination of hosting provider, IP reputation, and phishing artifacts elevates the risk profile of this domain.

Mitigation requires immediate network-level blocking of luqmanwazir69.github.io and IP 185.199.108.153 at firewall/DNS layers, followed by user awareness training focusing on credential input hygiene and HTTPS domain verification. Security teams should inspect gateway logs for HTTP POST requests to this domain and validate any GitHub.io subdomains against known organizational repositories. Users encountering this domain should report it to their security team and avoid interaction entirely.