3verify[.]github[.]io

PhishDestroy identifies active credential phishing infrastructure hosted at 3verify[.]github[.]io, a domain impersonating Microsoft’s 365 login portal to harvest enterprise user credentials. This malicious activity poses a direct threat to organizations relying on Microsoft cloud services, as it exploits trust in the Microsoft brand to deceive victims into surrendering login credentials. The domain leverages GitHub Pages as a hosting platform, capitalizing on the platform’s reputation to bypass traditional security filters. Given the absence of detections by 95 security vendors on VirusTotal, this threat remains under the radar despite its potential impact.

This domain was flagged using seed 155e06 and exhibits several indicators of compromise. Registered through GitHub, Inc., the domain resolves to IP address 185.199.108.153 and utilizes a Let’s Encrypt SSL certificate to enhance its appearance of legitimacy. The domain currently shows zero detections on VirusTotal (0/95), indicating it has not yet been widely recognized as malicious by security vendors. While the exact registration date is not publicly available, the domain’s use of GitHub Pages suggests a recent deployment to maximize the window of opportunity before discovery. There are no current entries in major blocklists or reputable threat intelligence feeds, further underscoring its stealthy posture. The combination of GitHub hosting, unflagged status, and SSL encryption creates a convincing facade that could easily deceive end users.

Organizations should immediately block inbound and outbound traffic to 3verify[.]github[.]io at the network perimeter to prevent access to the credential harvesting page. Users must be advised to scrutinize any unexpected login prompts, particularly those delivered via email or embedded links, and to verify the domain in the URL bar before entering credentials. Since the domain leverages HTTPS, traditional SSL inspection or certificate pinning policies may be required to decrypt and inspect traffic for malicious payloads. Implementing browser-based controls to block access to GitHub Pages domains or enforcing a deny list for known impersonation patterns could reduce exposure. Additionally, enabling multi-factor authentication (MFA) for Microsoft 365 accounts can mitigate the impact of credential theft, as compromised credentials alone would not grant access without secondary verification.