kmantu763[.]github[.]io

This domain, kmantu763.github.io, operates as a credential harvesting phishing endpoint designed to mimic legitimate login portals. Analysis indicates the infrastructure is used to capture usernames, passwords, and potentially multi-factor authentication codes through cloned interfaces of financial institutions, email providers, or corporate access gateways. The threat actor appears to leverage GitHub Pages' free hosting to rapidly deploy and rotate phishing kits while maintaining operational security through short-lived campaigns. Infrastructure analysis reveals the domain is registered through GitHub, Inc. and resolves to IP address 185.199.108.153, a known GitHub Pages hosting node. Security vendors on VirusTotal flag this domain with 13/95 detections, including classifications for phishing, fraud, and malicious content. The domain appears on 2 independent security blocklists and maintains an active Let's Encrypt SSL certificate (R12), which may be used to lend false legitimacy to victim interactions. While the current page title displays 'Site not found', historical analysis suggests the domain previously hosted active phishing content that has since been rotated or taken down. Users who have visited kmantu763.github.io should immediately revoke any credentials entered on the site, particularly if the page resembled a login portal. Monitor associated accounts for unauthorized access attempts and enable multi-factor authentication where available. Security teams should add the domain to web filtering solutions and investigate network logs for connections to 185.199.108.153 or related GitHub Pages subdomains. Given the high-risk nature of credential harvesting, affected individuals should consider password resets for any accounts with shared credentials. The domain's use of legitimate hosting infrastructure demonstrates the need for continuous monitoring of free-tier cloud services for malicious activity.