rafayrehman786[.]github[.]io

PhishDestroy identifies rafayrehman786.github.io as an active generic phishing domain under investigation, posing a high risk to unsuspecting users. This domain leverages GitHub's infrastructure to host deceptive content, exploiting the platform's trustworthiness to bypass initial scrutiny. This domain was flagged with a risk level of under_investigation and is currently active. VirusTotal reports 16/95 detections, indicating no immediate signature-based warnings, while the domain resolves to IP 185.199.108.153. Registered through GitHub, Inc., it employs a Let's Encrypt SSL certificate to appear legitimate. The unique seed identifier 0470db confirms its entry in the phishing database for further tracking and analysis. Mitigation for this threat involves immediate avoidance of the domain and any associated links or forms. Users should verify URLs independently, use browser-based phishing detection tools, and report suspicious domains to security teams or platforms like GitHub for takedown. Organizations should block this IP (185.199.108.153) and domain at the network level to prevent access. Given the low detection rate, behavioral analysis and threat intelligence sharing are critical to preventing credential theft or malware delivery through this vector.