salaheddinena[.]github[.]io

Analysis of salaheddinena.github.io indicates a GitHub-hosted phishing domain that was active until recently and has since been taken offline. The domain, registered on April 15, 2026, resolved to the IP address 185.199.108.153, which is part of GitHub, Inc.'s infrastructure in the United States. The site returned an HTTP 404 status with the page title 'Site not found · GitHub Pages,' suggesting it was either removed or never fully deployed. Infrastructure analysis reveals the use of GitHub Pages, Fastly, and Varnish technologies, which are legitimate but frequently abused for hosting malicious content due to their low cost and ease of deployment. Security vendors have flagged this domain, with 14 of 94 detection engines on VirusTotal identifying it as malicious.

Additionally, the domain appears on one security blocklist, and it has been blocked by PhishDestroy. The Gridinsoft trust score for this domain is 0 out of 100, further indicating its high-risk nature. The SSL certificate is issued by Let's Encrypt (R12), a common certificate authority used by both legitimate and malicious sites. No nameservers were detected, which may suggest an incomplete or hastily configured setup.

While the exact content of the phishing page is not available for analysis, the combination of GitHub Pages hosting, a 404 status, and detection by multiple security vendors strongly suggests malicious intent. Defenders should treat this domain as compromised and ensure it is blocked at the network level. Organizations using GitHub Pages for legitimate purposes should monitor for unauthorized repository creations or unexpected deployments, as these may indicate abuse of their infrastructure. Given the domain's current offline status, further investigation into its activity prior to takedown may be limited, but historical DNS and traffic logs could provide additional context.