moinulit265736[.]github[.]io

Analysis of the domain moinulit265736.github.io indicates that it is actively being used for a generic phishing campaign. The domain is hosted on GitHub Pages, resolving to the IP address 185.199.111.153, which is associated with GitHub’s content‑delivery infrastructure. Registration records show the domain was created through GitHub, Inc., confirming that the hosting provider is the same entity that operates the underlying infrastructure. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy platform, demonstrating that at least one external threat‑intelligence service has taken mitigation action against it.

VirusTotal reports that the domain was scanned by 91 security vendors, none of which raised a detection; however, the absence of detections does not constitute a safety assurance and should be interpreted in the context of the other indicators. Nameserver information is unavailable (NS_NOT_FOUND), limiting the ability to trace upstream DNS delegation. No additional metadata such as page title, SSL certificate details, or Safe Browsing status is currently available, so the surface‑level attributes of the site remain unverified.

Given the confirmed hosting on a reputable CDN, the malicious activity likely relies on the perceived trust of the GitHub domain to evade user scrutiny. Defenders should add the full hostname to network‑level blocklists, monitor DNS queries for the IP 185.199.111.153, and consider extending existing URL filtering policies to include this subdomain. Continuous re‑evaluation is advised, as the domain’s status is listed as active and could evolve with further malicious content or additional detection signatures.