vtkjhfrkjf358kdd[.]github[.]io

vtkjhfrkjf358kdd.github.io was observed hosting a page whose title reads “Security Check – Cloudflare”. The HTTP response returned a 404 status code, indicating the requested resource was not found. The site was served via GitHub Pages and employed a Let’s Encrypt certificate (R12) for TLS termination. DNS resolution points to 185.199.108.153, an address owned by Fastly (ASN 54113) located in the United States. Infrastructure fingerprints include Varnish caching, Fastly edge delivery, and the GitHub Pages platform, all of which are consistent with a typical static‑site hosting arrangement.

The domain was listed on a single public blocklist and is actively blocked by PhishDestroy, suggesting that at least one security‑focused organization identified it as malicious. VirusTotal scans have been performed by 95 vendors, none of which reported a detection; however, the absence of detections does not constitute a safety guarantee. The domain is currently taken offline, and its status is recorded as “offline” in the intelligence feed. Evidence confirms that the domain was used for a generic phishing campaign, though the specific lure or credential‑stealing vector has not been captured in the available data. No additional indicators such as malicious payload hashes, phishing kits, or target brand references have been disclosed.

Consequently, the precise content and intent of the page remain uncertain beyond the observed title and hosting characteristics. Defenders should continue to block the domain at network perimeter and DNS filtering layers, monitor for any resurrection of the host under the same IP address or ASN, and incorporate the observed TLS fingerprint and IP address into threat‑intel feeds. Periodic re‑scanning of the domain, should it become active again, is recommended to capture any evolving payloads or new detection signals.