dilshad-980[.]github[.]io

This domain, dilshad-980.github.io, is actively serving phishing content hosted on GitHub Pages infrastructure. Analysis indicates the site is flagged by Google Safe Browsing for social engineering, a classification that aligns with observed phishing activity. The domain currently resolves to 185.199.111.153, a known GitHub Pages IP address, and is served through Fastly and Varnish caching layers, which are common for legitimate GitHub Pages deployments but also frequently abused for phishing. Security vendors on VirusTotal have detected malicious activity, with 13 out of 95 engines flagging the domain. The domain appears on at least one security blocklist, reinforcing its classification as a confirmed phishing endpoint. The SSL certificate is issued by Let's Encrypt, a legitimate provider often used in both benign and malicious contexts, and does not provide conclusive evidence of intent. The domain lacks configured nameservers, which is consistent with GitHub Pages' default behavior but does not rule out malicious use. Defenders should note that the site returns an HTTP 404 status, which may indicate the phishing content has been removed or is being served conditionally. However, the domain remains active and should be treated as compromised until further verification. Given the GitHub Pages hosting context, defenders are advised to monitor for re-deployment of phishing content, as attackers frequently reuse such infrastructure. Blocking or sinkholing the domain at the network level is recommended, particularly in environments where GitHub Pages is not a business requirement. No brand impersonation or specific phishing kit details are currently available, so detection should focus on the domain itself and its associated IP.