seitentaisei1304[.]github[.]io

The domain seitentaisei1304.github.io is involved in a high-risk credential theft phishing campaign. There is no direct evidence of brand impersonation or use of a specific drainer kit, but the site targets users to steal login credentials. This activity poses significant risk to users who may unknowingly disclose sensitive information.

Technical indicators include a VirusTotal detection ratio of 16 out of 95 security vendors flagging the domain. It is registered through GitHub, Inc., a common platform abused for hosting phishing content due to its free hosting capabilities. The domain resolves to IP address 185.199.108.153, which is associated with GitHub Pages hosting. Google Safe Browsing classifies the domain under the SOCIAL_ENGINEERING category, indicating it is used to manipulate users into sharing personal data. Additionally, the domain appears on one security blocklist and is already blocked by OpenPhish. The SSL certificate is issued by Let's Encrypt, which facilitates encrypted communications but does not guarantee legitimacy.

Currently, the domain remains active and continues to pose a high risk to users. The presence on multiple detection platforms and blocklists shows it has been recognized as malicious by the security community. Users should avoid interacting with the domain and never enter credentials or personal information. Organizations should consider blocking this domain at the network level and educate users on identifying phishing attempts hosted on legitimate platforms like GitHub Pages. Continuous monitoring and reporting to threat intelligence feeds will support mitigation efforts.