fortflarefn[.]github[.]io

PhishDestroy identifies fortflarefn.github.io as an active phishing site impersonating Cloudflare login pages to steal user credentials. The domain uses a GitHub Pages subdomain to appear legitimate while hosting a fake login form that captures entered usernames and passwords. Security researchers note this technique is particularly dangerous as GitHub's reputation may lower user suspicion, making victims more likely to enter sensitive information. This domain was flagged by 5 out of 95 VirusTotal security vendors at the time of analysis. The infrastructure resolves to IP address 185.199.108.153 and uses a Let's Encrypt SSL certificate to appear trustworthy. The domain was registered through GitHub's Pages service, which allows attackers to create subdomains under github.io that can host malicious content while leveraging GitHub's legitimate infrastructure. The combination of GitHub hosting, free SSL certificates, and Cloudflare branding creates a highly convincing trap for unsuspecting users. If you visited fortflarefn.github.io and entered any credentials, immediately change your Cloudflare password and enable two-factor authentication. Scan your device for malware using reputable antivirus software and monitor your accounts for suspicious activity. Report the domain to your IT security team and consider using a password manager that can detect fake login pages. Never enter sensitive information on sites accessed through unsolicited links, even if they appear legitimate.