cassmiya387[.]github[.]io

This investigation documents the malicious infrastructure observed for the domain cassmiya387.github.io as of July 29, 2026. The domain is hosted on GitHub Pages, a service that provides static site hosting under the github.io sub‑domain. DNS resolution returns the IPv4 address 185.199.110.153, which belongs to the GitHub network and is consistent with other github.io sites. The domain has been added to one public security blocklist and is actively blocked by the PhishDestroy mitigation platform. VirusTotal analysis shows that 16 of 91 scanned security vendors have flagged the domain as malicious, indicating a moderate level of consensus among automated scanners.

The detection count suggests that the site exhibits characteristics typical of generic phishing campaigns, though no specific brand or credential‑stealing page title has been publicly disclosed. The available intelligence does not include a retrieved page title, SSL certificate details, or explicit content classification beyond the generic phishing label. Consequently, the precise lure, victim targeting, and any payload delivery mechanisms remain unknown. The presence on a blocklist and the multi‑vendor detections provide sufficient operational evidence to treat the domain as hostile.

Defenders should add cassmiya387.github.io to URL filtering rules, edge firewall deny lists, and endpoint web‑proxy block lists. Continuous monitoring of the associated IP address (185.199.110.153) and the GitHub Pages hosting range is advised, as threat actors often recycle subdomains within the same provider. Automated security tools that query VirusTotal or similar reputation services can be tuned to trigger alerts when the detection count reaches the observed threshold. Organizations should also consider reviewing any outbound connections to github.io domains for anomalous activity, especially if users have not explicitly requested access to developer or documentation resources.