muditgolaa[.]github[.]io

This domain, muditgolaa.github.io, is identified as a credential theft operation designed to harvest user login credentials through deceptive GitHub Pages impersonation. Analysis indicates the site mimics legitimate GitHub Pages infrastructure, leveraging the platform's hosting capabilities to appear authentic while executing malicious credential capture scripts. No direct evidence of a crypto drainer kit or brand-specific impersonation (e.g., Microsoft, PayPal) was observed, but the credential theft mechanism aligns with phishing frameworks targeting developer or cloud service accounts. Infrastructure analysis reveals critical technical indicators: the domain is flagged by 19 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly categorizing it as phishing. The domain is registered through GitHub, Inc., and resolves to the IP address 185.199.108.153, a known GitHub Pages hosting endpoint. The SSL certificate is issued by Let's Encrypt (R12), a common but non-exclusive indicator of legitimacy. The domain creation date is listed as March 26, 2026, which may suggest an attempt to evade detection by using a future-dated registration. It appears on one security blocklist, and its hosting location is traced to the United States under GitHub, Inc.'s infrastructure. As of the latest assessment, the domain remains active, though its GitHub Pages deployment currently returns a 'Site not found' error. This may indicate a temporary takedown, dormant state, or evasion tactic to reduce visibility while retaining infrastructure for future attacks. Users are advised to treat any prior or future interactions with this domain as compromised, particularly if login credentials were entered. Organizations should block the domain and IP at the network level, monitor for related indicators of compromise, and educate users on recognizing credential theft tactics. The risk level remains high due to the domain's persistence, hosting on a trusted platform, and historical malicious activity.