shreeshant-15[.]github[.]io

This domain, shreeshant-15.github.io, operates as a credential harvesting portal designed to mimic legitimate login interfaces. Analysis indicates the site collects usernames, passwords, and session tokens through fraudulent forms, enabling unauthorized account access. The threat extends to potential secondary attacks, including account takeovers and unauthorized transactions, once credentials are compromised. Users encountering this domain may be redirected from malicious ads, compromised websites, or phishing emails targeting corporate or personal accounts. Infrastructure analysis reveals the domain is hosted on GitHub Pages, resolving to IP 185.199.108.153 under AS54113 (Fastly, Inc.). The SSL certificate is issued by Let's Encrypt (YR2), a common tactic to appear legitimate. The domain is flagged by 6 out of 95 security vendors on VirusTotal, including PhishDestroy and OpenPhish blocklists. It appears on two additional security blocklists, confirming its malicious classification. The domain remains active as of the latest verification, with no evidence of takedown or remediation efforts. If a user visited shreeshant-15.github.io, immediate action is required to mitigate risk. First, terminate all active sessions on the affected device and disconnect from the network to prevent further data exfiltration. Reset passwords for all accounts accessed during the exposure window, prioritizing financial, email, and work-related services. Enable multi-factor authentication where available, using app-based or hardware tokens instead of SMS. Monitor accounts for unauthorized activity, including login attempts, password changes, or unfamiliar transactions. Report the incident to the organization's security team or relevant platform administrators to assist in broader threat containment.