shayan-yousuf-0099[.]github[.]io

shayan-yousuf-0099.github.io is an active domain observed on 31 July 2026 that has been classified as a generic phishing site. DNS resolution points to the IP address 185.199.108.153, which belongs to the GitHub Pages hosting service. The registrar record shows the domain was registered through GitHub, Inc., indicating the underlying infrastructure is provided by a legitimate cloud provider, but the malicious use is independent of the host. Automated analysis on VirusTotal indicates the domain was submitted to 91 scanning engines; none of the engines returned a detection at the time of the scan. Google Safe Browsing has flagged the URL for social‑engineering content, and the domain appears on a single external blocklist.

The nameserver query returned no results (NS_NOT_FOUND), suggesting the domain may be using default GitHub name servers or that the query failed. PhishDestroy currently blocks the domain, confirming that threat‑intel communities consider it malicious. The evidence points to a phishing campaign that leverages the credibility of GitHub Pages to host deceptive content, but the exact payload, page title, or targeted brand have not been disclosed in the available data. Because the hosting provider does not restrict the creation of arbitrary static sites, the domain can be rapidly re‑used for new campaigns.

Defenders should add 185.199.108.153 to outbound and inbound filtering rules where feasible, enforce URL filtering against the domain, and monitor for any future resolution changes. Continuous re‑scanning on multi‑engine platforms such as VirusTotal is advised, as detection status may evolve. Organizations should educate users about the presence of social‑engineering warnings from browsers and encourage verification of URLs before credential entry. The domain remains active; ongoing observation is recommended.