joao-paulo00[.]github[.]io

This domain, joao-paulo00.github.io, is flagged as a generic phishing site leveraging GitHub Pages infrastructure. Analysis indicates no direct brand impersonation, but the domain exhibits characteristics consistent with credential harvesting or malicious payload delivery. The absence of a visible page title beyond 'Site not found' suggests either a placeholder state or deliberate evasion of detection by removing overt phishing content while maintaining backend functionality. Infrastructure analysis reveals the domain resolves to IP address 185.199.108.153, a GitHub-hosted endpoint. It was registered through GitHub, Inc. on June 03, 2026, though this creation date may reflect an error or manipulation, as it predates the current year. VirusTotal detection shows 18 out of 95 security vendors flagging the domain, while Google Safe Browsing explicitly classifies it as phishing. The domain appears on one security blocklist, and its SSL certificate is issued by Let's Encrypt (R12), providing HTTPS encryption to lend legitimacy to the malicious activity. Current status remains active, with no evidence of takedown or remediation. The domain is blocked by at least one security filter, but residual risk persists due to its GitHub Pages hosting, which complicates traditional mitigation efforts. Users and organizations are advised to implement network-level blocking for 185.199.108.153 and monitor for subdomain variations of joao-paulo00.github.io. Security teams should treat any unexpected redirects or links to this domain as malicious and investigate associated endpoints for credential theft or malware distribution.