shruk6587-sketch[.]github[.]io

This domain is flagged as a high-risk credential harvesting site designed to impersonate GitHub login interfaces. Analysis indicates the page is engineered to capture user credentials, likely for unauthorized account access or subsequent malicious activity. The threat type is classified as a fake login page, with no evidence of additional payload delivery such as crypto drainers or malware distribution at this time. Infrastructure analysis reveals the domain shruk6587-sketch.github.io resolves to the IP address 185.199.108.153, a known GitHub Pages hosting endpoint. The domain is registered through GitHub, Inc., leveraging the platform's legitimate infrastructure to evade initial suspicion. The SSL certificate is issued by Let's Encrypt, providing a false sense of security. Detection metrics show 6 out of 95 security vendors on VirusTotal flagging the domain as malicious. The domain appears on two security blocklists, including PhishDestroy and OpenPhish, and holds a trust score of 0/100. Despite these indicators, the domain remains active as of the latest verification. Mitigation steps for this specific threat type include immediate blocking of the domain and its resolving IP address across network security controls. Organizations should deploy email and web filtering rules to prevent user access to the domain, particularly for messages or links referencing GitHub login prompts. Endpoint protection should be configured to detect and block credential harvesting attempts, with particular attention to browser-based phishing pages. Security teams are advised to monitor for unusual authentication attempts from internal accounts, as compromised credentials may be exploited rapidly. User awareness training should emphasize the risks of entering credentials on unsolicited login pages, even those hosted on seemingly legitimate platforms like GitHub Pages.