emmanuelfasida25-lab[.]github[.]io

PhishDestroy identifies emmanuelfasida25-lab.github.io as an active credential theft phishing domain currently deployed against unsuspecting visitors. This GitHub-hosted page mimics a legitimate service page to harvest user login credentials, creating a direct risk to account safety and data confidentiality. The threat remains live and accessible at the time of analysis, enabling ongoing exploitation if unchecked.

This domain was flagged by 10 of 95 VirusTotal security vendors within hours of detection and resolved to IP address 185.199.109.153 via GitHub Pages’ infrastructure. The SSL certificate was issued by Let’s Encrypt, ensuring encrypted traffic that may disguise malicious intent from basic network inspection tools. No public creation date is exposed due to GitHub’s privacy protections, but traffic patterns and VirusTotal submissions indicate recent deployment consistent with a fast-moving credential harvesting campaign.

Current status remains active and elevated, meaning the phishing page continues to operate and may lure users into entering credentials under false pretenses. Security teams and individual users are advised to block the domain at network and endpoint levels using indicators such as DNS sinkholing to 185.199.109.153 and URL filtering rules targeting the full path emmanuelfasida25-lab.github.io. Additionally, GitHub should be notified via abuse report to expedite takedown, and users who may have interacted are urged to rotate passwords immediately and enable multi-factor authentication on all related accounts to prevent follow-on compromise.