chodidurgaprasad37[.]github[.]io

This domain, chodidurgaprasad37.github.io, is flagged as a high-risk credential theft operation. Analysis indicates the site is designed to harvest login credentials, likely through fake authentication portals or cloned interfaces, exploiting GitHub Pages' legitimate hosting infrastructure to evade initial suspicion. The threat actor appears to target users by mimicking trusted services, with the end goal of unauthorized account access or identity theft. Infrastructure analysis reveals multiple technical indicators supporting this assessment. The domain resolves to IP address 185.199.108.153, registered through GitHub, Inc., and is hosted within the United States. Despite displaying a 'Site not found' page title, the domain remains active and is detected by 17 out of 95 security vendors on VirusTotal, while appearing on one security blocklist. The SSL certificate, issued by Let's Encrypt (R12), was created on March 26, 2026, an anomalous date suggesting potential manipulation of registration metadata. The domain is currently blocked by PhishDestroy, further corroborating its malicious nature. Mitigation against credential theft sites like chodidurgaprasad37.github.io requires a multi-layered approach. Organizations should implement domain-based blocking at the network level, ensuring all requests to this address are terminated before reaching end users. Endpoint protection systems should be updated to recognize and flag the domain's IP and SSL certificate thumbprint as malicious indicators. Users should be educated to verify URLs manually, particularly when prompted for credentials, and to cross-reference login pages with official sources. Given the domain's use of GitHub Pages, additional scrutiny should be applied to all user-generated content hosted on this platform, with automated scanning for cloned interfaces or suspicious redirects.