chamrai829927-prog[.]github[.]io

Analysis of chamrai829927-prog.github.io, observed on July 24, 2026, indicates the site was provisioned through GitHub Pages and served via the Fastly content‑delivery network (ASN 54113, United States). DNS resolution points to IP address 185.199.110.153, a host commonly associated with GitHub‑hosted static content. The site presented an HTTP 404 response and the TLS certificate was issued by Let’s Encrypt (R12 profile), confirming the use of a valid, publicly trusted certificate. The page title returned by the server is "Security Check - Cloudflare," suggesting an intermediate security checkpoint, though no further page content has been captured.

Detected technologies include Varnish caching, GitHub Pages infrastructure, and Fastly edge services. The domain has been listed on a single security blocklist and is actively blocked by the PhishDestroy filtering service. VirusTotal reports indicate the URL was scanned by 95 vendors, with none flagging it as malicious; however, the absence of detections does not constitute a safety assurance. Current status shows the domain is offline, and no additional artifacts such as malware payloads, credential‑harvesting forms, or brand‑specific impersonation have been observed.

Uncertainty remains regarding the intended phishing vector, the target brand, and any payload that may have been delivered prior to takedown. Defenders should continue to block the domain at perimeter defenses, monitor DNS queries for the associated IP range, and consider adding the host to internal blocklists. Ongoing intelligence collection is recommended to capture any future re‑hosting attempts or related infrastructure that may be leveraged in subsequent campaigns.