yahya-masood[.]github[.]io

This domain, yahya-masood.github.io, is currently under investigation as a confirmed phishing endpoint hosted on GitHub Pages infrastructure. Analysis indicates the domain is actively resolving to 185.199.108.153, a known GitHub IP address range, and is registered through GitHub, Inc. The domain appears on one security blocklist (PhishDestroy) but has not been flagged by any of the 91 vendors that scanned it on VirusTotal as of the latest check. The absence of detections does not confirm safety, particularly given the domain's presence on a blocklist and the lack of nameserver records, which may indicate an attempt to obscure tracking or evade detection. Infrastructure review reveals the domain is leveraging GitHub's legitimate hosting service, a common tactic for phishing campaigns due to the free, trusted nature of the platform.

Defenders should note that GitHub Pages domains are frequently abused for credential harvesting, malware distribution, or social engineering attacks, though the specific content or target of this domain remains unconfirmed. The domain's active status and blocklist inclusion warrant immediate attention, particularly for organizations that permit GitHub Pages traffic. Recommended actions include blocking the domain at the network perimeter, monitoring for internal access attempts, and reviewing logs for connections to 185.199.108.153. If GitHub Pages is not required for business operations, consider restricting access to the entire *.github.io namespace.

Security teams should also investigate whether this domain has been used in recent phishing emails or messages, as GitHub-hosted phishing sites are often disseminated via email or social engineering. Further analysis of the page content is required to determine the exact phishing kit or brand impersonation, if any. Given the domain's active status and blocklist presence, defenders should treat it as malicious until proven otherwise.