khankhaznavik-spec[.]github[.]io

PhishDestroy identifies khankhaznavik-spec.github.io as a high-risk credential harvesting phishing domain currently active in the wild. This GitHub-hosted page poses a direct threat to user credentials by masquerading as a legitimate service, specifically targeting victims through social engineering tactics. The domain leverages a Let's Encrypt SSL certificate to appear trustworthy, while its infrastructure (IP 185.199.108.153) hosts malicious content designed to dupe victims into submitting sensitive information.

This domain was flagged by 16 out of 95 security vendors on VirusTotal, with additional detections from OpenPhish and Google Safe Browsing, which explicitly categorized it under SOCIAL_ENGINEERING threats. The domain is registered through GitHub, Inc., resolving to IP 185.199.108.153, a known malicious hosting provider. It appears on one security blocklist, reinforcing its malicious reputation. The use of a legitimate hosting provider (GitHub Pages) complicates detection, as the infrastructure itself is not inherently malicious but is being exploited for phishing purposes. The SSL certificate issued by Let's Encrypt further lends an air of authenticity, tricking users into believing the site is secure.

To mitigate exposure to this threat, users should immediately block all traffic to khankhaznavik-spec.github.io at the network and endpoint levels. Organizations are advised to update firewall rules, DNS sinkholes, and proxy filters to prevent access to this domain. Security teams should also inspect internal logs for any historical or ongoing connections to this IP (185.199.108.153) or the domain itself. Since this threat relies on social engineering, user awareness training emphasizing skepticism toward unsolicited login prompts is critical. Any credentials entered into this page should be considered compromised, and users should undergo password resets and multi-factor authentication enrollment where applicable. Immediate incident response is recommended if any interaction with this domain is detected.