muhammadwaleedqazi[.]github[.]io

This domain, muhammadwaleedqazi.github.io, is actively engaged in credential harvesting phishing operations targeting users through deceptive login interfaces masquerading as legitimate services. Analysis indicates the infrastructure is designed to capture sensitive authentication details, including usernames, passwords, and potentially multi-factor authentication codes, by presenting fraudulent replicas of trusted platforms. The domain leverages GitHub Pages hosting to evade traditional detection mechanisms, exploiting the reputation of a widely used development platform to bypass initial scrutiny and increase the likelihood of successful compromise. Infrastructure analysis reveals the domain resolves to the IP address 185.199.110.153, associated with GitHub, Inc., and is registered through the same entity. Despite its recent creation date of March 26, 2026, the domain has already been flagged by 17 out of 95 security vendors on VirusTotal, indicating a rapid escalation in detection. It appears on one confirmed security blocklist, with Google Safe Browsing explicitly categorizing it as a phishing threat. The SSL certificate, issued by Let's Encrypt (R12), provides encrypted communication, further lending an illusion of legitimacy to unsuspecting users. The page title, 'Site not found · GitHub Pages,' suggests an attempt to obfuscate malicious activity behind a generic error message, a tactic commonly employed to delay discovery. Users who have interacted with this domain should immediately terminate any active sessions and assume their credentials have been compromised. All passwords associated with accounts accessed during the interaction period must be reset using a secure, unrelated device. Multi-factor authentication tokens or recovery codes used on the domain should be revoked and replaced. System administrators are advised to block the domain and its resolving IP address (185.199.110.153) at the network perimeter to prevent further exposure. Monitoring for unauthorized access or anomalous activity in linked accounts is critical, particularly within 24-48 hours of potential exposure. Organizations should review logs for connections to the domain or IP to assess the scope of any breach.