sujarajan1725[.]github[.]io

This domain, sujarajan1725.github.io, is actively engaged in credential harvesting through fake login portals hosted on GitHub Pages infrastructure. Analysis indicates the site impersonates legitimate services to trick users into submitting sensitive information, including usernames, passwords, and potentially multi-factor authentication codes. The threat actor leverages GitHub's free hosting to distribute phishing content, exploiting the platform's reputation to bypass initial security filters and increase the likelihood of successful compromise. Technical evidence confirms the domain's malicious nature through multiple indicators. VirusTotal reports 17 out of 95 security vendors flagging the domain as malicious, while it appears on two independent security blocklists. The domain was registered through GitHub, Inc. on April 12, 2026, and currently resolves to the IP address 185.199.108.153, which is part of GitHub's content delivery network. Infrastructure analysis reveals the use of a Let's Encrypt SSL certificate (R12), providing an illusion of legitimacy while maintaining operational security for the threat actor. Users who have visited sujarajan1725.github.io should immediately take corrective action. First, terminate any active sessions on the site and avoid entering any credentials. Second, change passwords for any accounts accessed from the same device or network, prioritizing email and financial services. Third, enable multi-factor authentication on all critical accounts if not already active. Fourth, scan the affected device using updated security tools to detect potential malware infections. Organizations should block the domain at the network level and monitor for credential reuse attempts across enterprise systems. The domain remains active as of this report, with Google Safe Browsing continuing to flag it as phishing infrastructure.