mhamedkbt[.]github[.]io

The domain mhamedkbt.github.io is currently classified as a high‑risk generic phishing site. Analysis confirms that the domain resolves to the IP address 185.199.108.153, which is owned by GitHub, Inc., the registrar listed for the registration. The lack of publicly resolvable name‑server information (NS_NOT_FOUND) limits visibility into DNS‑level controls, but the IP mapping establishes a clear hosting relationship with GitHub’s infrastructure.

VirusTotal reports that 15 of 91 security vendors flag the domain, indicating a moderate consensus of malicious intent across independent detection engines. Google Safe Browsing has labeled the site as a social‑engineering threat, reinforcing the phishing assessment. The domain is presently blocked by the PhishDestroy service and appears on a single external security blocklist, demonstrating that at least one threat‑intelligence feed is actively monitoring it.

No additional public intelligence, such as page titles, SSL certificates, or detailed payload characteristics, has been disclosed, leaving the exact phishing vector and target audience unknown. Defenders should continue to enforce blocking of the domain at perimeter and DNS layers, monitor the associated IP for any anomalous traffic, and update local threat feeds to include the observed blocklist entry. Ongoing surveillance of the domain’s DNS records and any future VirusTotal or Safe Browsing updates is recommended to capture changes in threat posture.