sekhariam[.]github[.]io

This domain, sekhariam.github.io, is actively serving as a phishing infrastructure designed to impersonate legitimate GitHub Pages services. Analysis indicates the site is engineered to harvest user credentials, session tokens, or other sensitive authentication data by mimicking trusted GitHub-hosted content. The domain leverages GitHub's free hosting platform to appear authentic, increasing the likelihood of successful deception against developers, IT personnel, or general users who may not scrutinize the subdomain structure closely. The threat extends beyond basic phishing, as the infrastructure could be used to distribute malicious payloads or conduct follow-on attacks such as account takeovers or lateral movement within compromised environments.

Technical evidence confirms the domain's malicious intent through multiple detection layers. VirusTotal reports 18 out of 95 security vendors flagging sekhariam.github.io as malicious, with Google Safe Browsing explicitly categorizing it as phishing. The domain was registered through GitHub, Inc. on April 04, 2026, and resolves to the IP address 185.199.108.153, a known GitHub Pages hosting endpoint. Despite its recent creation date, the domain appears on one security blocklist, and its SSL certificate, issued by Let's Encrypt (R12), provides a false sense of security. The page title, 'Site not found · GitHub Pages,' suggests an attempt to mask malicious activity behind a benign error message, a tactic often used to evade casual detection while maintaining operational readiness for targeted campaigns.

Users who have visited sekhariam.github.io should take immediate remedial action to mitigate potential compromise. First, terminate any active sessions on the site and avoid entering credentials or downloading content. If authentication details were submitted, reset passwords for all associated accounts, particularly those linked to GitHub or other development platforms, and enable multi-factor authentication where available. Review recent account activity for unauthorized access or changes, and monitor connected devices for signs of malware or unusual network traffic. Organizations should block the domain and its resolving IP (185.199.108.153) at the network perimeter, and consider revoking or rotating any exposed credentials as a precaution. Security teams are advised to analyze logs for connections to this domain and investigate any correlated suspicious behavior.