xyros-01[.]github[.]io

Analysis of xyros-01.github.io indicates that the domain is actively being used for a generic phishing campaign. The site is listed on a single security blocklist and is explicitly blocked by the PhishDestroy service, demonstrating that at least one independent threat‑intelligence feed has identified malicious activity. Google Safe Browsing classifies the URL under the social engineering category, which aligns with the generic phishing designation. VirusTotal has recorded 15 positive detections out of 91 scanned security vendors, confirming that multiple scanners have observed suspicious behavior associated with the domain.

The domain resolves to the IP address 185.199.110.153, which belongs to the GitHub Pages hosting infrastructure. Registration details show that the domain is provisioned through GitHub Pages, a legitimate service that is often abused to host malicious payloads because of its free, globally distributed CDN. No additional metadata such as SSL certificate details, HTTP response codes, page title, or content analysis has been provided, leaving the exact nature of the hosted page unknown. The lack of publicly available page‑level intelligence means defenders cannot confirm which brand or credential collection form is being targeted, but the collective evidence from blocklists, Safe Browsing, and multi‑vendor detections is sufficient to treat the domain as high‑risk.

Defenders should immediately add xyros-01.github.io to outbound web filtering rules, enforce DNS‑based blocking, and consider sinkholing the associated IP address to disrupt traffic. Continuous monitoring of the IP 185.199.110.153 for new hostnames and periodic re‑scans on VirusTotal are recommended to capture any evolution of the campaign. Organizations should also educate users about the presence of generic phishing links and encourage verification of URLs before credential entry.