md-habibullah-99.github.io hosts generic phishing campaign

Analysis date: July 26, 2026. The domain md-habibullah-99.github.io is currently classified as a high-risk generic phishing infrastructure and remains active. Registration information shows the domain is hosted through GitHub, Inc., with no publicly visible nameserver records (NS_NOT_FOUND). DNS resolution points to the IP address 185.199.108.153, which belongs to GitHub’s static content delivery network. The hosting environment therefore benefits from the reputation of a major cloud provider, potentially masking malicious activity.

Reputation services have flagged the domain on two independent blocklists, and both PhishDestroy and OpenPhish list it as a confirmed phishing source. VirusTotal scans indicate that seven out of ninety-one security vendors have raised detections, confirming that at least a subset of scanners recognize malicious behavior. No additional intelligence such as page title, SSL certificate details, or HTTP response codes is available in the current dataset, leaving the exact content of the site unverified. Defenders should continue to block the domain at network perimeters and update endpoint protection signatures to include the observed detections.

Monitoring of the IP address 185.199.108.153 for anomalous traffic patterns is advisable, as the address may host other malicious payloads alongside legitimate GitHub resources. Because the domain leverages a reputable registrar and CDN, passive DNS and TLS fingerprinting can help distinguish benign GitHub traffic from abuse. Organizations that rely on GitHub-hosted assets should implement strict allow-list policies and consider employing content-security policies that restrict loading of external scripts from unapproved origins. Ongoing observation of blocklist status and VirusTotal detection counts is recommended to capture any escalation in threat activity.