adityachaurasia1676[.]github[.]io

This domain, adityachaurasia1676.github.io, is identified as a credential theft operation leveraging GitHub Pages infrastructure. Analysis indicates the threat actor deployed a phishing framework designed to harvest login credentials, likely targeting unsuspecting users through deceptive landing pages. No specific brand impersonation or cryptocurrency drainer kit has been confirmed, though the domain exhibits characteristics of a generic credential harvesting campaign. The absence of a visible brand suggests a broad, opportunistic approach rather than a targeted impersonation of a particular service. Infrastructure analysis reveals the domain resolves to 185.199.108.153, an IP address assigned to AS54113 (Fastly, Inc.), a provider commonly used for content delivery and hosting. The domain is registered through GitHub, Inc., with no creation date publicly disclosed, though GitHub Pages typically provisions subdomains dynamically. Google Safe Browsing explicitly flags the domain as phishing, while VirusTotal reports 12 out of 95 security vendors detecting malicious activity. The domain appears on one security blocklist, and its SSL certificate, issued by Let's Encrypt (R12), remains valid, adding a layer of legitimacy to the malicious endpoint. The page title, 'Site not found · GitHub Pages,' suggests the phishing content may have been removed or is being served selectively to evade detection. Current status indicates the domain remains active, though the visible GitHub Pages error page may imply temporary takedown or evasion tactics. Response actions should include immediate blocking of the domain and its resolving IP at the network level, alongside monitoring for related subdomains or newly provisioned GitHub Pages instances. The remaining risk is high due to the domain's persistence, SSL validity, and low detection rate on some security platforms. Organizations are advised to enforce strict access controls for GitHub Pages-hosted content and implement real-time credential monitoring to detect potential compromises stemming from this campaign.