sajid7147.github.io: Active GitHub Pages Credential Phishing Site

This domain, sajid7147.github.io, is currently flagged as an active credential phishing site. Analysis indicates the infrastructure is being exploited to mimic legitimate authentication portals, likely targeting users of popular web services or enterprise platforms. The domain remains operational despite detection, posing a high risk to unsuspecting visitors who may disclose sensitive login credentials or personal information. Infrastructure analysis reveals the domain resolves to IP address 185.199.108.153, hosted by GitHub, Inc. in the United States. It is registered through GitHub Pages, a legitimate service often abused for phishing due to its free hosting and trusted SSL certificates. The domain is flagged by 14 of 95 security vendors on VirusTotal, with one active security blocklist entry. The SSL certificate is issued by Let's Encrypt (R12), a common choice for threat actors due to its ease of acquisition and short validity periods. No specific creation date is available, but the domain's GitHub Pages origin suggests recent deployment, typical of phishing campaigns that rotate infrastructure frequently. Current status confirms the domain remains active, serving a "Site not found" page that may indicate either a staging phase or a cloaking mechanism to evade detection. Users are advised to block the domain at the network level and monitor for connections to 185.199.108.153. Organizations should review logs for interactions with sajid7147.github.io, particularly from endpoints that handle sensitive data. Security teams are recommended to update detection rules to include this domain and its associated IP, as well as to conduct awareness training highlighting the risks of GitHub Pages-hosted phishing sites.