tchiinhemba-frontend-projects[.]github[.]io

This domain, tchiinhemba-frontend-projects.github.io, is flagged as a high-risk credential harvesting site leveraging GitHub Pages infrastructure. Analysis indicates the threat type is generic phishing, specifically designed to mimic legitimate login portals to capture user credentials, session tokens, or other sensitive authentication data. While no specific brand impersonation or drainer kit signatures have been confirmed, the domain's structure and hosting pattern align with known phishing campaigns exploiting free hosting services to evade detection and reduce operational costs. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 185.199.108.153, hosted in the United States under GitHub, Inc. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites. The domain was registered on April 21, 2026, through GitHub, Inc., with an anomalous future creation date suggesting potential domain spoofing or registry manipulation. VirusTotal detection shows 13 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The page currently displays a 'Site not found' message, which may indicate a temporary takedown, cloaking mechanism, or staging phase before full deployment. Current status remains active, with the domain still resolving and no confirmed suspension by the hosting provider. The anomalous creation date and GitHub Pages hosting are notable red flags, as threat actors frequently abuse free hosting services to launch phishing campaigns with minimal overhead. While the 'Site not found' page reduces immediate exposure, the domain retains potential for reactivation. Users and organizations are advised to block resolution at the DNS or network level, monitor for changes in page content, and implement multi-factor authentication to mitigate credential theft risks. The remaining risk is classified as high due to the domain's active status, detection by multiple security vendors, and the persistent threat of credential harvesting attacks.