ahmedraza-176[.]github[.]io

PhishDestroy identifies the domain ahmedraza-176.github.io as an active Microsoft 365 credential phishing campaign. The site is currently live and poses an elevated risk to unsuspecting users who may disclose corporate or personal credentials through deceptive login portals.

This domain was flagged by 17 of 95 VirusTotal security vendors, confirming malicious intent. Registered through GitHub, Inc., the domain resolves to IP 185.199.108.153 and operates under a Let’s Encrypt SSL certificate to appear legitimate. While exact creation timestamps are not publicly available, the presence of active blocklist entries and low trust scores across multiple detection engines strongly correlates with confirmed phishing infrastructure. The combination of a free-hosted GitHub Pages subdomain and spoofed Microsoft brand elements creates a rapidly propagating threat vector.

Users and organizations are strongly advised to block ahmedraza-176.github.io at network and endpoint levels due to confirmed phishing content. Immediate actions include updating browser blacklists, inspecting DNS logs for outbound connections to 185.199.108.153, and warning Microsoft 365 users to verify sender domains before entering credentials. Given the elevated risk and confirmed detection ratio, this domain meets PhishDestroy’s criteria for immediate remediation and public reporting.