edu4life[.]github[.]io

PhishDestroy identifies edu4life.github.io as an active credential harvesting portal impersonating legitimate educational services to deceive users into surrendering login credentials. The domain leverages GitHub Pages hosting to lend false legitimacy while operating as a malicious frontend for data exfiltration. Analysis reveals consistent redirection to fraudulent login forms mimicking academic portals, specifically targeting students and faculty under the guise of 'edu4life' educational resources.

This domain was flagged by multiple security vendors after VirusTotal analysis confirmed malicious intent, with 13 out of 95 engines detecting phishing artifacts. Registered through GitHub's platform, the domain has been blocked by two prominent blocklists (OpenPhish and OISD) and resolves to IP 185.199.108.153 under a Let's Encrypt SSL certificate, suggesting attempts to appear trustworthy. While GitHub’s infrastructure is leveraged for hosting, the content hosted on edu4life.github.io remains unassociated with any legitimate educational entity, as confirmed by cross-referencing known academic domains.

Users who accessed this domain should immediately change passwords for any accounts entered on the page, enable two-factor authentication where available, and scan local devices for malware using updated antivirus software. Enterprises should block this domain at the firewall level and investigate endpoints for signs of credential compromise. Report any observed interactions to your security team to aid in broader threat intelligence sharing.