saliq6500-cmd[.]github[.]io

This domain is assessed as HIGH risk and classified as a generic_phishing infrastructure associated with credential theft activity. The page is hosted under a GitHub Pages subdomain and currently displays a "Site not found" template, which can be leveraged in phishing campaigns to host transient or rotated malicious content. The risk is elevated due to confirmed security vendor detections and active listing status, indicating ongoing malicious usage potential.

Technical intelligence shows multiple corroborating indicators of compromise. VirusTotal reports 17/95 security vendors flagging the domain as malicious or suspicious. The domain was registered through GitHub, Inc. and created on June 15, 2026. It resolves to IP 185.199.108.153 under GitHub Pages infrastructure. It is flagged by Google Safe Browsing for phishing activity and appears on at least 1 additional security blocklist, specifically PhishDestroy. The SSL certificate is issued by Let's Encrypt / R12, providing encrypted transport but not indicating trust legitimacy. The combination of trusted hosting infrastructure, minimalistic hosting page state, and multiple independent detections suggests potential abuse of legitimate hosting services for credential harvesting or redirect-based phishing chains.

Mitigation requires proactive blocking and monitoring due to the domain’s active status and high likelihood of content rotation. Users should avoid entering credentials on any page served from this subdomain or similar GitHub Pages structures without verified ownership. Security teams should ingest IP 185.199.108.153 and domain-level indicators into web filtering and threat intelligence systems. Email and browser protection layers should flag GitHub Pages subdomains with suspicious patterns or random alphanumeric naming conventions. If users have interacted with the page, they should immediately change any potentially exposed credentials, enable multi-factor authentication, and review account access logs for unauthorized activity. Continuous monitoring is recommended due to the ease of re-deployment on the underlying hosting platform.