eku2in008-create[.]github[.]io

This domain, eku2in008-create.github.io, is identified as an active crypto credential harvester designed to capture wallet login credentials through deceptive interfaces. Analysis indicates the site employs a cloned wallet login portal, likely targeting users of decentralized finance platforms. The phishing kit appears to be a generic credential harvester, though no specific brand impersonation has been conclusively linked at this stage. The infrastructure is hosted on GitHub Pages, a common tactic for low-cost, high-availability phishing deployments. Technical indicators confirm the domain resolves to the IP address 185.199.108.153, a known GitHub Pages endpoint. The domain is registered through GitHub, Inc., with no explicit creation date available due to GitHub Pages' dynamic hosting model. VirusTotal detection metrics show 6 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing categorizes it under SOCIAL_ENGINEERING. The SSL certificate is issued by Let's Encrypt, a frequent choice for phishing sites to mimic legitimacy. No additional blocklist entries beyond these sources have been recorded at this time. As of the latest verification, the domain remains active and continues to serve phishing content. No takedown actions have been observed, and the GitHub repository associated with the domain has not been removed. The remaining risk is classified as high due to the domain's operational status and the potential for credential theft. Users are advised to avoid interaction with the domain, and organizations should implement network-level blocks on the IP address 185.199.108.153. Security teams are encouraged to monitor for related GitHub Pages subdomains, as this infrastructure is frequently reused for phishing campaigns.