bhumikabhilkar[.]github[.]io

This domain is flagged as a high-risk credential theft operation designed to harvest user login credentials through deceptive login portals. Analysis indicates the site masquerades as a legitimate service to trick victims into entering sensitive authentication details, which are then exfiltrated to attacker-controlled infrastructure. The threat type is specifically credential theft, not generic phishing or crypto-related fraud. Infrastructure analysis reveals the domain bhumikabhilkar.github.io is hosted on GitHub Pages infrastructure, resolving to IP address 185.199.108.153 with a Let's Encrypt SSL certificate (R12). The domain was registered on April 15, 2026, through GitHub, Inc. and remains active despite detection by 6 out of 95 security vendors on VirusTotal. The domain appears on one security blocklist and is currently blocked by PhishDestroy. The page title 'Site not found · GitHub Pages' suggests either a placeholder or a cloaking mechanism to evade detection. Organizations and users should implement the following mitigation measures: immediately block the domain and its resolving IP (185.199.108.153) at the network perimeter. Deploy endpoint protection rules to detect and prevent access to the domain. Conduct a retrospective analysis of network logs to identify any prior connections to this domain, particularly from endpoints that may have transmitted credentials. Reset credentials for any accounts that may have been exposed through this domain. Educate users on recognizing credential theft tactics, including unexpected login prompts and domain spoofing techniques. Monitor for similar GitHub Pages-based credential theft domains, as this hosting method provides attackers with free, reputable infrastructure that can bypass traditional security controls.