luckygole[.]github[.]io

This domain, luckygole.github.io, is flagged for credential theft activity targeting users through deceptive GitHub Pages hosting. Analysis indicates no direct brand impersonation or cryptocurrency drainer kit association, but the domain exhibits characteristics of a credential harvesting campaign leveraging GitHub's legitimate infrastructure to evade initial detection. The absence of a functional page title (Site not found · GitHub Pages) suggests either a placeholder or a recently dismantled phishing page, which may be reactivated or redirected to an external malicious endpoint. Infrastructure analysis reveals the domain resolves to IP address 185.199.108.153, associated with GitHub, Inc., and is hosted within the United States. The domain was registered through GitHub, Inc. on March 31, 2026, an anomalous creation date likely indicative of a typo or misconfiguration in threat intelligence feeds. VirusTotal detection metrics show 12 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is currently classified as active. SSL certificate analysis confirms a Let's Encrypt R12 certificate, providing encrypted communication that may be exploited to lend false legitimacy to phishing attempts. Current status remains active, with no evidence of takedown or mitigation at the infrastructure level. Response actions should include immediate blocking of the domain and associated IP at network perimeter controls, alongside monitoring for related subdomains or newly registered GitHub Pages with similar naming patterns. Remaining risk is assessed as high due to the domain's persistence, potential for reactivation, and exploitation of trusted hosting services. Organizations are advised to audit logs for connections to 185.199.108.153 and review GitHub Pages usage policies to prevent abuse of legitimate cloud services for credential theft campaigns.