kasmli313univ[.]github[.]io

This domain is flagged as a high-risk credential theft phishing site, designed to harvest login credentials through deceptive login portals. Analysis indicates the infrastructure leverages GitHub Pages for hosting, a tactic increasingly observed in credential-focused attacks due to its perceived legitimacy and free SSL certificates. Infrastructure analysis reveals the domain kasmli313univ.github.io was registered on June 12, 2026, through GitHub, Inc., and resolves to the IP address 185.199.111.153. Security vendor detections on VirusTotal report 7 out of 95 flags, while the domain appears on one security blocklist. The SSL certificate is issued by Let's Encrypt (R12), a common choice for phishing sites due to its free and automated issuance process. The page title, 'Site not found · GitHub Pages,' suggests either a placeholder or an attempt to evade detection by mimicking a benign error state. Mitigation for credential theft threats involves immediate blocking of the domain and associated IP address (185.199.111.153) at the network perimeter. Security teams should inspect logs for connections to this domain or IP, particularly from endpoints exhibiting unusual authentication attempts. User awareness training should emphasize the risks of entering credentials on untrusted sites, even those hosted on seemingly legitimate platforms like GitHub Pages. Additionally, monitoring for Let's Encrypt certificates issued to GitHub Pages subdomains may help identify similar threats.