canburnlikeacigarette[.]github[.]io

This domain is flagged as an active generic phishing endpoint under investigation. Analysis indicates the infrastructure is being used to deliver credential-harvesting or fraudulent content, though the exact payload remains unclassified. The domain is hosted on GitHub Pages, a legitimate platform often abused for low-cost, high-availability phishing operations. Infrastructure analysis reveals the domain resolves to IP address 185.199.109.153, a shared GitHub Pages server. It is registered through GitHub, Inc., and uses a Let's Encrypt SSL certificate for encrypted connections. As of the latest scan, VirusTotal reports 0/95 detections, indicating no antivirus engines have flagged the domain yet. The domain remains active and unblocked across major threat intelligence feeds, with no known creation date or historical abuse records available in public datasets. Mitigation steps for this threat type include immediate monitoring of network traffic to 185.199.109.153, particularly for connections to canburnlikeacigarette.github.io. Security teams should implement URL filtering to block access to the domain and inspect SSL certificates for Let's Encrypt issuances tied to GitHub Pages subdomains. Given the zero-detection status, manual analysis of the phishing page is recommended to extract indicators such as form fields, redirect chains, or embedded scripts. Organizations should also review GitHub Pages usage policies and restrict access to untrusted repositories or user-generated content hosting platforms.