tgzqn8hfh2-alt[.]github[.]io

PhishDestroy classifies tgzqn8hfh2-alt.github.io as a HIGH-RISK credential harvesting phishing domain actively engaged in fraudulent operations. This GitHub-hosted page impersonates legitimate services to steal user credentials and should be treated with extreme caution.

This domain was flagged by 15 out of 95 VirusTotal security vendors, indicating widespread recognition of its malicious nature. It resolves to IP address 185.199.108.153 and utilizes a Let's Encrypt SSL certificate for added legitimacy. Registered through GitHub, Inc., this phishing infrastructure has been active since its creation, with no available creation date suggesting recent deployment. The domain remains unlisted on major blocklists despite its detection rate, indicating either a newly emerged threat or evasion tactics in its operation.

Organizations and individuals should immediately block access to tgzqn8hfh2-alt.github.io at network and endpoint levels. Users who may have interacted with this domain should change credentials immediately, particularly if the same credentials were reused across services. Implementing browser-based protections and email filtering rules to detect similar GitHub-hosted phishing attempts is strongly recommended. GitHub should be alerted to investigate and potentially suspend this malicious repository to prevent further credential harvesting activities.