aliforouzand1987[.]github[.]io

On July 20 2026, aliforouzand1987.github.io was identified as a high‑risk generic phishing infrastructure. The domain is hosted on GitHub Pages and resolves to the IP address 185.199.108.153, which belongs to the GitHub, Inc. hosting network. Registration information shows the domain was created through GitHub, Inc., confirming that the attacker leveraged a legitimate cloud‑based code‑hosting service to obtain a free sub‑domain. The domain is currently listed on one security blocklist and has been blocked by the PhishDestroy feed, indicating that at least one external remediation service has taken action against it. VirusTotal analysis reports that 7 of 91 scanned security vendors flagged the domain, providing independent corroboration of malicious activity. No nameserver records were returned, which is consistent with the default GitHub Pages configuration that does not expose custom NS records.

The available evidence does not include a page title, SSL certificate details, HTTP response codes, or any observed payloads, so the exact phishing lure and target brand remain unverified. Likewise, the absence of additional blocklist entries or open‑source intelligence (e.g., OTX) limits the assessment of campaign scope. Nonetheless, the combination of a malicious sub‑domain, active blocklist status, and multiple vendor detections establishes a credible threat profile.

Defenders should add aliforouzand1987.github.io to URL filtering and DNS deny lists, monitor outbound traffic for connections to 185.199.108.153, and enforce web‑gateway policies that block content from known phishing feeds such as PhishDestroy. Continuous re‑scanning on VirusTotal and periodic checks of GitHub Pages sub‑domains are recommended to detect potential re‑use of the same hosting infrastructure.