kriisshhnnaa[.]github[.]io

The domain kriisshhnnaa.github.io is currently flagged as an active credential theft phishing site. Analysis indicates the infrastructure is designed to harvest user login credentials, likely through fake authentication portals or cloned login pages. The domain remains operational and has not been taken down despite detection by multiple security mechanisms. Infrastructure analysis reveals the domain is hosted on GitHub Pages and resolves to the IP address 185.199.111.153, registered under AS54113 (Fastly, Inc.) in the United States. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites. Security vendors have flagged this domain in 14 of 95 VirusTotal scans, with one additional entry on a security blocklist. Google Safe Browsing explicitly designates the domain as phishing, and it is blocked by at least one threat intelligence feed. The page title, 'Site not found · GitHub Pages,' suggests an attempt to mimic legitimate GitHub Pages errors while potentially serving malicious content through obfuscated redirects or hidden scripts. Current status confirms the domain remains active and unresolved. Organizations and individuals are advised to block the domain at the DNS or network level to prevent credential exposure. Endpoint protection systems should be updated to include this indicator of compromise (IOC) in their threat intelligence feeds. Users who may have interacted with the domain should immediately reset credentials for any accounts accessed during the exposure window. Monitoring for unusual authentication attempts or unauthorized access is recommended, particularly for accounts linked to GitHub or other development platforms.