nurmuhammaddev1[.]github[.]io

This domain, nurmuhammaddev1.github.io, is confirmed to host a fake Microsoft login page designed to harvest user credentials. Analysis of the page structure and embedded scripts indicates a credential phishing campaign targeting corporate and personal Microsoft accounts. The site mimics the official Microsoft login interface, including cloned branding and input fields, with no immediate signs of a cryptocurrency drainer or payment redirection component. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 9 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly marking it as phishing. The domain is registered through GitHub Pages and resolves to the IP address 185.199.109.153, hosted on AS54113 (Fastly, Inc.) in the United States. The SSL certificate is issued by Let's Encrypt (R12), providing HTTPS encryption to lend false legitimacy. The domain appears on one security blocklist, though the exact creation date remains obscured due to GitHub Pages' hosting model. As of the latest verification, the phishing site remains active and accessible. While one security vendor has blocked access, the lack of broader takedown measures poses a continued risk to users. Organizations and individuals are advised to block the domain at the network level and update endpoint protection rules to prevent access. Users who may have entered credentials on this site should immediately reset their Microsoft account passwords and enable multi-factor authentication. The domain's persistence on a widely used hosting platform underscores the need for heightened scrutiny of subdomains under github.io.