abhishekkumarguptadev[.]github[.]io

This domain, abhishekkumarguptadev.github.io, is confirmed as an active credential theft phishing site. Analysis indicates the infrastructure is designed to harvest user login credentials through deceptive login portals hosted on GitHub Pages. No specific brand impersonation or cryptocurrency drainer kit signatures have been identified, but the domain exhibits classic credential harvesting tactics, including SSL-enabled spoofed forms and obfuscated redirection chains. The lack of visible content under the current page title (Site not found · GitHub Pages) suggests either a staging phase or takedown of the active phishing page, though the underlying infrastructure remains operational. Technical indicators confirm the domain resolves to IP address 185.199.108.153, registered through GitHub, Inc., with a Let's Encrypt SSL certificate (R12). The domain was created on April 14, 2026, and is currently flagged by 17 out of 95 security vendors on VirusTotal. It appears on one security blocklist and is actively blocked by PhishDestroy. The IP geolocation traces to the United States, hosted on GitHub's infrastructure. No Google Safe Browsing (GSB) detections were reported at the time of analysis, though this may reflect a lag in propagation rather than a clean status. The domain remains active as of this report, posing a persistent risk for credential theft campaigns. While the visible GitHub Pages error suggests a temporary lull in malicious activity, the presence of SSL certificates, blocklist entries, and vendor detections indicates ongoing abuse potential. Users and organizations are advised to block the domain at the network level and monitor for related subdomains or IP-based connections. Security teams should treat any login prompts originating from this infrastructure as fraudulent and implement multi-factor authentication (MFA) as a mitigation against credential theft. The domain's use of legitimate hosting services complicates takedown efforts, requiring continued vigilance for reactivation attempts.