joaobof8[.]github[.]io

This domain, joaobof8.github.io, is actively engaged in credential theft operations targeting users through deceptive GitHub Pages infrastructure. Analysis indicates the site mimics legitimate login portals or redirects victims to fraudulent authentication forms designed to harvest usernames, passwords, and session tokens. The threat extends to potential secondary payloads, such as malware distribution or follow-on social engineering attacks, leveraging the stolen credentials to compromise additional accounts or systems. The use of GitHub Pages, a trusted hosting service, increases the likelihood of successful deception due to its association with a reputable platform. Infrastructure analysis reveals multiple indicators of malicious activity. The domain is flagged by 9 out of 95 security vendors on VirusTotal, with detections spanning categories such as phishing, fraud, and unauthorized access attempts. It resolves to the IP address 185.199.108.153, registered under GitHub, Inc., and was created on May 20, 2026, an anomalous future date suggesting potential domain spoofing or registry manipulation. The domain appears on one security blocklist, and its SSL certificate, issued by Let's Encrypt (R12), provides encrypted connections to evade basic network-based detection. Despite its current inactive appearance—displaying a 'Site not found' page—the domain remains operational for malicious redirections or conditional payload delivery. Users who have visited joaobof8.github.io or interacted with its content should take immediate remediation steps. First, revoke any active sessions associated with accounts accessed during the exposure window, particularly those linked to GitHub or other development platforms. Second, reset passwords for all potentially compromised accounts using strong, unique credentials and enable multi-factor authentication where available. Third, monitor account activity for unauthorized access or transactions, and report any suspicious behavior to the respective platform's security team. If system-level interactions occurred, such as downloading files or executing scripts, conduct a full security scan to detect and remove any installed malware or backdoors.