mubarakkhan-8710032[.]github[.]io

PhishDestroy flags mubarakkhan-8710032.github.io as an active credential theft domain. The site impersonates a legitimate service to harvest user credentials, posing as a generic login interface. No crypto drainer kit signatures are detected, but the domain leverages GitHub Pages for hosting, which increases trust and lowers user suspicion. The infrastructure is minimal, suggesting a low-cost, high-reach campaign targeting unsuspecting users.

Technical indicators confirm malicious activity. The domain resolves to IP 185.199.108.153 and is registered via GitHub, Inc. Let’s Encrypt provides SSL encryption, while Google Safe Browsing labels the domain under SOCIAL_ENGINEERING. VirusTotal currently shows 6/95 detections, indicating it remains undetected by most antivirus engines. The domain was created recently, and its infrastructure aligns with phishing operations designed to evade early detection.

Current status is active with a high risk of credential theft. Immediate actions include blocking the domain at the network perimeter and updating blocklists with the IP and domain. Users should avoid clicking links and report suspicious activity. Remaining risk is elevated due to low detection rates and the use of trusted hosting providers. Continuous monitoring is required to mitigate further compromise.