thebossman400[.]github[.]io

The domain thebossman400.github.io is a phishing platform that exploits GitHub's hosting services. Detected by PhishDestroy on June 21, 2026, it has since been taken down. Despite its offline status, the domain was flagged as malicious by 9 out of 91 vendors on VirusTotal, indicating significant recognition of its threat potential.

The domain's hosting IP, 185.199.111.153, is located in the US and is managed by Fastly, Inc. This infrastructure choice allowed the threat actors to leverage GitHub's reputation and Let's Encrypt SSL certification to appear legitimate. The domain's platform risk score is notably high at 83 out of 100, reflecting its potential impact and threat level.

Despite being offline, the domain's presence on a public blocklist and its abuse score of 27 out of 100 underscore its malicious intent. The swift detection by PhishDestroy highlights the importance of early identification in mitigating phishing threats. This case exemplifies how phishing domains can exploit trusted platforms like GitHub to deceive users, emphasizing the need for continuous monitoring and rapid response to emerging threats.