ltri15591-arch[.]github[.]io

The domain ltri15591-arch.github.io is currently active and has been observed on a single security blocklist. Technical probing shows that it resolves to the IP address 185.199.108.153, which belongs to the GitHub hosting infrastructure. Registration metadata indicates the domain was created through GitHub, Inc., confirming the use of a legitimate registrar to obscure malicious intent. VirusTotal scans have returned detections from 13 of 91 security vendors, suggesting that multiple anti‑malware engines have identified malicious characteristics associated with the host. The domain is also listed as blocked by the PhishDestroy threat‑intelligence feed, reinforcing its classification as a phishing resource.

Nameserver data is unavailable (NS_NOT_FOUND), limiting insight into the authoritative DNS configuration. No additional public intelligence such as Safe Browsing verdicts, OTX references, SSL certificate details, HTTP response codes, or page title information has been disclosed, leaving the exact content and delivery mechanisms of the phishing campaign unverified. Consequently, defenders cannot confirm the specific lures or credential‑harvesting forms employed, but the aggregate evidence—active status, hosting on a reputable platform, multiple vendor detections, and inclusion on a dedicated phishing blocklist—supports a high‑risk assessment.

Mitigation guidance for security teams includes adding ltri15591-arch.github.io to DNS blocklists and firewall deny lists, monitoring outbound traffic for connections to 185.199.108.153, and applying URL filtering rules that reference the domain. Organizations should also ensure endpoint protection solutions are updated to include the latest signatures that flag this domain, given the existing VirusTotal detections.