pwn-rathore[.]github[.]io

This domain, pwn-rathore.github.io, is identified as a high-risk generic phishing threat actively targeting users through impersonation of GitHub Pages infrastructure. Analysis confirms its operational status, with no legitimate content hosted but clear indicators of malicious intent designed to harvest credentials or distribute malware under the guise of a trusted platform. Infrastructure analysis reveals critical technical indicators: the domain is flagged by 18 of 95 security vendors on VirusTotal, indicating widespread detection as malicious. It is registered through MarkMonitor, Inc., a registrar commonly associated with both legitimate and fraudulent domains, and resolves to the IP address 185.199.110.153, hosted on AS54113 (Fastly, Inc.) in the United States. The SSL certificate is issued by Let's Encrypt (R12), providing a false sense of security. The domain was created on February 21, 2026, an anomalous future date suggesting potential registry manipulation or data obfuscation. It appears on one security blocklist, and its page title, 'Site not found · GitHub Pages,' is a deliberate tactic to mimic legitimate GitHub Pages error messages while masking its true purpose. Current status remains active, posing an ongoing risk to unsuspecting users. Organizations and individuals are advised to block this domain at the DNS or network level immediately. Security teams should monitor for connections to 185.199.110.153 and review logs for any interaction with pwn-rathore.github.io. End users should be educated to recognize GitHub Pages impersonation tactics, particularly error pages or unexpected redirects. If credentials were entered on this domain, they must be reset immediately, and multi-factor authentication should be enforced on all associated accounts. Proactive threat hunting for related indicators, such as the SSL certificate thumbprint or anomalous Let's Encrypt issuance patterns, is recommended to identify potential lateral movement or secondary infections.