come-review[.]github[.]io

This domain is flagged as a high-risk brand impersonation threat specifically targeting Facebook users through a fraudulent Meta Verified verification scheme. The site mimics official Facebook authentication flows to harvest login credentials, payment details, and personal information under the guise of account verification or premium service enrollment. Analysis indicates this is a calculated credential theft operation with potential secondary objectives including malware distribution or follow-on social engineering attacks. Infrastructure analysis reveals the domain come-review.github.io is registered through GitHub, Inc., resolving to IP address 185.199.109.153 within AS54113 (Fastly, Inc.) located in the United States. The SSL certificate is issued by Let's Encrypt (YR2), a common tactic to lend false legitimacy to phishing infrastructure. VirusTotal detection metrics show 13 out of 95 security vendors flagging the domain as malicious, while PhishDestroy has already implemented blocking measures. The domain appears on one security blocklist, and the page title explicitly references 'Meta Verified – Facebook,' directly associating with the targeted brand. No legitimate creation date or historical context is available, suggesting the domain was recently provisioned for this specific campaign. Mitigation requires immediate action from both end users and security teams. Users should avoid interacting with the domain, particularly any authentication prompts or payment requests. Security teams should implement DNS-level blocking for come-review.github.io and the associated IP 185.199.109.153, while monitoring for related subdomains or GitHub Pages variations. Credential monitoring should be enhanced for accounts potentially exposed to this campaign, with forced password resets and multi-factor authentication enforcement. Network defenders should analyze traffic patterns to 185.199.109.153 for signs of compromise, particularly POST requests to verification endpoints. Given the GitHub Pages origin, organizations should review their GitHub Enterprise policies to prevent similar abuse of their infrastructure for phishing operations.