ahmad-344[.]github[.]io

This domain, ahmad-344.github.io, is flagged as a high-risk phishing site specializing in brand impersonation. Analysis indicates the infrastructure is designed to mimic legitimate services, tricking users into entering sensitive credentials or downloading malicious payloads. The site leverages GitHub Pages for hosting, a common tactic to exploit trusted platforms and evade initial suspicion. Users may encounter fake login portals, fraudulent support pages, or cloned corporate sites, all intended to harvest personal or financial data. Infrastructure analysis reveals concrete indicators of compromise. The domain resolves to 185.199.108.153, an IP address associated with GitHub, Inc., and is registered through the same provider. Despite displaying a 'Site not found' page title, the domain remains active and is detected by 15 out of 95 security vendors on VirusTotal, including Google Safe Browsing. It appears on two security blocklists, including PhishDestroy and PhishingDB, confirming its malicious classification. The SSL certificate is issued by Let's Encrypt, a legitimate provider often abused to lend false credibility to phishing sites. If you or someone in your organization visited ahmad-344.github.io, immediate action is required. First, disconnect the affected device from the network to prevent potential data exfiltration. Run a full system scan using updated security tools to detect and remove any malware or unauthorized scripts. Reset all passwords for accounts accessed during or after the visit, prioritizing email, financial, and administrative credentials. Monitor accounts for unusual activity, such as unauthorized transactions or login attempts. Report the incident to your internal security team or a trusted incident response provider to assess potential exposure. Avoid re-engaging with the domain, as it remains active and poses an ongoing threat.