luanmcarvalho[.]github[.]io

This domain is flagged as an active high-risk credential theft operation targeting Airbnb users. Analysis indicates the infrastructure is designed to harvest login credentials through brand impersonation, a tactic commonly associated with account takeover fraud and unauthorized access to sensitive user data. Infrastructure analysis reveals the domain luanmcarvalho.github.io is registered through GitHub, Inc. and resolves to IP address 185.199.108.153, located in the US under AS54113 (Fastly, Inc.). The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites. Security vendors on VirusTotal detect the domain at 6/95, while PhishDestroy and one additional security blocklist have already classified it as malicious. The page title explicitly mimics Airbnb, reinforcing the credential theft intent. Mitigation steps for this specific threat type include immediate blocking of the domain and IP at network perimeter controls. Organizations should deploy browser-based warnings for users attempting to access the site, particularly those originating from Airbnb-related search queries or email links. End-users should be educated to verify domain authenticity before entering credentials, especially on pages hosted on third-party platforms like GitHub Pages. Incident responders should monitor for successful logins from this IP or domain as indicators of compromise.