arnab-zt[.]github[.]io

This domain is flagged as a high-risk credential harvesting phishing site targeting user login credentials. Analysis indicates the infrastructure is designed to mimic legitimate authentication portals, a common tactic in targeted phishing campaigns. The domain remains active despite detection by security systems, suggesting ongoing malicious intent. Infrastructure analysis reveals the domain arnab-zt.github.io is registered through GitHub, Inc. and resolves to the IP address 185.199.108.153, located in the United States. The domain was created on April 07, 2026, and is currently hosted on GitHub Pages, which provides a legitimate-appearing SSL certificate issued by Let's Encrypt (R12). Security vendors on VirusTotal flag the domain at a rate of 14/95, and it appears on one security blocklist. The page title, 'Site not found · GitHub Pages,' may indicate an attempt to mask malicious activity or a placeholder for future phishing content. Mitigation steps for this specific threat type include immediate blocking of the domain and its resolving IP address (185.199.108.153) at the network perimeter. Organizations should implement email filtering rules to quarantine messages containing links to arnab-zt.github.io and conduct retrospective scans for any prior exposure. End-user training should emphasize the risks of credential harvesting phishing, particularly those leveraging cloud-hosted pages. Security teams are advised to monitor for similar GitHub Pages-based phishing domains, as threat actors frequently rotate infrastructure within this hosting environment.