maggyleet[.]github[.]io

Analysis as of July 29, 2026 classifies maggyleet.github.io as a high‑risk, active phishing infrastructure. The domain is hosted on GitHub Pages, as indicated by the registrar record showing registration through GitHub, Inc. DNS resolution points to the IP address 185.199.108.153, which is part of the standard GitHub Pages hosting range. Nameserver information is missing (NS_NOT_FOUND), suggesting that the domain relies on GitHub's default DNS configuration. The site has been listed on a single security blocklist and is actively blocked by the PhishDestroy service, reinforcing the view that it is being used for malicious purposes.

Google Safe Browsing flags the domain for social engineering, a category that aligns with phishing behavior. VirusTotal analysis reports that 15 out of 91 security vendors have flagged the domain, providing additional independent confirmation of its malicious nature. No public evidence is available regarding the page title, SSL certificate details, or HTTP response codes, leaving the exact content of the site unverified.

Given the convergence of blocklist inclusion, safe‑browsing warning, and multi‑vendor detections, defenders should treat maggyleet.github.io as a confirmed phishing host. Recommended mitigations include adding the domain to outbound web filters, monitoring network traffic for connections to 185.199.108.153, and updating intrusion detection signatures to capture any associated payloads. Continuous re‑evaluation is advised in case the hosting environment changes or further intelligence emerges.