rohitprajapati23[.]github[.]io

This domain, rohitprajapati23.github.io, is actively engaged in credential theft targeting Netflix users. Analysis of the page title and visual elements confirms brand impersonation of Netflix, a common tactic to deceive victims into submitting login credentials. The infrastructure appears to lack overt cryptocurrency drainer functionality, focusing instead on harvesting account details for resale or unauthorized access to streaming services and linked payment methods. Technical indicators reveal multiple high-confidence flags. The domain resolves to IP address 185.199.111.153, hosted on AS54113 (Fastly, Inc.) in the United States. It is registered through GitHub, Inc., leveraging GitHub Pages for deployment. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious domains. Google Safe Browsing explicitly flags this domain as phishing, and it appears on one additional security blocklist. VirusTotal detection shows 8 out of 95 security vendors marking the domain as malicious, with detections spanning credential theft and brand impersonation categories. As of the latest verification, rohitprajapati23.github.io remains active, posing an ongoing risk to users. The domain has not been sinkholed or taken down, and no public remediation efforts by the registrar or hosting provider have been observed. Users are advised to avoid interacting with this domain and to verify the legitimacy of any Netflix-related communications by accessing the official website directly. Organizations should update blocklists to include this domain and its associated IP address. The continued operation of this infrastructure underscores the need for real-time monitoring of emerging phishing campaigns, particularly those leveraging trusted hosting platforms to evade detection.