ayushi3003[.]github[.]io

This domain, ayushi3003.github.io, is actively engaged in credential theft operations targeting unsuspecting users. Analysis indicates the infrastructure is designed to impersonate legitimate login portals, tricking visitors into submitting sensitive authentication details such as usernames, passwords, and multi-factor authentication codes. The domain leverages GitHub Pages, a free hosting service, to lend an appearance of legitimacy while concealing its malicious intent. The threat actor likely exploits the trust associated with GitHub’s brand to bypass initial user skepticism, increasing the likelihood of successful compromise. Technical indicators confirm the high-risk nature of this domain. The domain resolves to the IP address 185.199.108.153, which is associated with GitHub, Inc. and located in the United States. It is flagged by 17 out of 95 security vendors on VirusTotal, with additional detections on two independent security blocklists. The SSL certificate is issued by Let’s Encrypt, a common tactic to avoid raising suspicion through unencrypted connections. Despite the page title displaying 'Site not found · GitHub Pages,' the underlying malicious content remains accessible through direct links or embedded redirects, indicating an attempt to evade casual detection while maintaining operational functionality. Users who have visited ayushi3003.github.io or interacted with its content should take immediate remedial action. First, terminate any active sessions on devices used to access the domain and disconnect from the network to prevent potential lateral movement. Second, reset credentials for all accounts accessed or entered during the suspected compromise, prioritizing email, financial, and administrative accounts. Enable multi-factor authentication where available, using app-based or hardware tokens instead of SMS-based methods. Monitor accounts for unauthorized activity, including logins, transactions, or configuration changes. If sensitive data was exposed, consider reporting the incident to relevant data protection authorities and follow organizational or personal incident response protocols.