smilie0qwe[.]github[.]io

Analysis of smilie0qwe.github.io indicates an active phishing domain hosted on GitHub Pages infrastructure, resolving to the IP address 185.199.109.153. This domain is flagged by 13 of 91 security vendors on VirusTotal, a detection ratio that supports an elevated risk classification. The domain appears on at least one security blocklist, specifically PhishDestroy, further corroborating its malicious status. Registration details confirm the domain is provisioned through GitHub Pages, a legitimate but frequently abused service for hosting phishing content due to its free, low-friction nature and association with trusted GitHub infrastructure. Infrastructure analysis reveals the IP 185.199.109.153 is part of GitHub’s content delivery network, commonly used for static site hosting.

While this IP is not inherently malicious, its use in this context aligns with known phishing delivery patterns. No additional details regarding SSL certificates, HTTP response codes, or page content are available in the current evidence set. The absence of further technical indicators—such as ASN, geolocation, or brand impersonation details—limits deeper attribution, but the combination of vendor detections and blocklist presence provides sufficient grounds for defensive action. Defenders should treat this domain as an active phishing threat.

Network-level blocking at the domain and IP level is recommended, particularly in environments where GitHub Pages is not a business requirement. Security teams should review logs for connections to 185.199.109.153 or smilie0qwe.github.io to identify potential compromised endpoints. Given the domain’s hosting on GitHub Pages, takedown requests should be directed to GitHub’s abuse reporting channels, referencing the specific repository or user account associated with this subdomain.