sachin-chourasiya[.]github[.]io

This domain, sachin-chourasiya.github.io, is currently active and flagged as a credential theft infrastructure. Analysis indicates the site is designed to impersonate financial service providers or authentication portals, tricking users into submitting sensitive login credentials. The lack of identifiable brand logos or specific drainer kit signatures suggests a generic but highly effective credential harvesting operation, likely targeting users through phishing emails or malicious redirects. Infrastructure analysis reveals the following technical indicators: the domain is registered through GitHub, Inc. and resolves to IP address 185.199.108.153, hosted on AS54113 (Fastly, Inc.) in the United States. The SSL certificate is issued by Let's Encrypt (YR2), providing a false sense of security to potential victims. As of the latest scan, 9 out of 95 security vendors on VirusTotal flag this domain as malicious. The domain appears on two security blocklists, including PhishDestroy and OpenPhish, and remains unlisted on Google Safe Browsing. No creation date is publicly available due to GitHub Pages' hosting model, but the domain's activity has been continuous over recent monitoring periods. Current status shows the domain remains active and operational, with no takedown actions observed. The high-risk classification stems from its persistent credential theft activity, broad detection across security platforms, and hosting on a reputable but abused content delivery network. Users are advised to block all connections to 185.199.108.153 and sachin-chourasiya.github.io at the network level. Organizations should update endpoint protection rules to include this domain and IP in denylists, and conduct internal audits for any prior exposure. Given the domain's continued operation, heightened vigilance is recommended for any communications or redirects involving this infrastructure.