hulyacrk[.]github[.]io

This domain, hulyacrk.github.io, is flagged as a high-risk credential harvesting site designed to mimic legitimate login portals and capture user credentials. Analysis indicates the threat type is generic phishing, with a specific focus on impersonating trusted platforms to deceive targets into submitting sensitive authentication details. The domain remains active and poses a significant risk to individuals and organizations due to its operational status and deceptive infrastructure. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 185.199.108.153, which is part of GitHub’s content delivery network. It is registered through GitHub, Inc., leveraging the platform’s Pages service to host malicious content. The SSL certificate is issued by Let’s Encrypt, providing an appearance of legitimacy. VirusTotal detection shows 3 out of 95 security vendors have flagged this domain as malicious, indicating early but growing awareness of its threat. The page title, Projeler | hulyacrk.github.io, suggests a benign project page, further masking its true intent. No historical creation date is provided, but the domain’s continued operation and hosting on a trusted platform amplify its reach and effectiveness. Mitigation steps should focus on immediate containment and user awareness. Network administrators are advised to block access to 185.199.108.153 and the domain hulyacrk.github.io at the perimeter level. Endpoint protection systems should be updated to include this domain and associated IP in blocklists. Users should be educated on recognizing phishing attempts, particularly those hosted on legitimate platforms like GitHub, and encouraged to verify URLs before entering credentials. Multi-factor authentication should be enforced wherever possible to mitigate the impact of credential theft. Monitoring for unusual login attempts or access patterns can help detect compromised accounts linked to this phishing campaign.