subrotoroy10000[.]github[.]io

PhishDestroy identifies active abuse of the GitHub Pages subdomain subrotoroy10000.github.io in a high-risk fake giveaway scam campaign. The domain is weaponized to impersonate legitimate prize or reward notifications, coercing victims into entering credentials or downloading malicious attachments under the guise of claiming non-existent rewards. All traffic is served from IP 185.199.108.153 and secured with a Let’s Encrypt TLS certificate, increasing perceived legitimacy and evading passive browser warnings. The domain exhibits multiple red flags confirmed by reputable threat intelligence sources. VirusTotal reports 16 out of 95 participating security vendors flagging the domain, indicating broad detection but not universal protection. The domain was registered with GitHub, Inc., leveraging GitHub’s free Pages hosting to bypass traditional domain reputation checks. Google Safe Browsing has classified the URL under the SOCIAL_ENGINEERING category, confirming intent to deceive users rather than deliver benign content. Furthermore, the infrastructure maps to a known GitHub edge network, which threat actors frequently abuse for short-lived campaigns to evade takedowns and domain blacklists. Users who visited subrotoroy10000.github.io should immediately cease any interaction, avoid entering credentials or downloading files, and scan connected devices with updated endpoint protection. If credentials were entered, rotate passwords immediately and enable multi-factor authentication on all critical accounts. Report the domain to your organization’s security team and submit a report via Google Safe Browsing to help accelerate delisting. Organizations should block the domain at DNS and proxy levels using the indicators: domain subrotoroy10000.github.io and IP 185.199.108.153.