ianpavlovic[.]github[.]io

This domain is flagged as a high-risk credential harvesting phishing endpoint targeting users through deceptive GitHub Pages infrastructure. Analysis indicates the site employs a 'Site not found' error page as a decoy while actively harvesting login credentials, session tokens, or sensitive personal data in the background. The threat type is classified as generic_phishing with a focus on credential theft, likely leveraging social engineering tactics to trick victims into submitting sensitive information. Infrastructure analysis reveals the domain is registered through GitHub, Inc., resolving to the IP address 185.199.108.153, located in the United States. The domain was created on March 28, 2026, an anomalous future date suggesting potential domain spoofing or registry manipulation. It is currently blocked by one security blocklist and flagged by 3 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Let's Encrypt (R12), providing a false sense of security while facilitating encrypted exfiltration of stolen data. The domain remains active despite its deceptive error page, indicating ongoing malicious operations. Mitigation steps for this specific threat include immediate blocking of the domain and its resolving IP address (185.199.108.153) at the network perimeter. Security teams should monitor for outbound connections to this IP and domain, particularly from endpoints where users may have interacted with phishing lures. End-user education should emphasize verifying GitHub Pages URLs and scrutinizing unexpected 'Site not found' errors, which may mask active credential harvesting attempts. Additionally, organizations should review logs for anomalous Let's Encrypt certificate usage tied to this domain, as attackers may reuse similar infrastructure for future campaigns.