tatendahjames-glitch[.]github[.]io

This domain, tatendahjames-glitch.github.io, is currently active and identified as a credential theft operation. Analysis indicates the infrastructure is designed to harvest user login credentials through cloned authentication interfaces, likely targeting unsuspecting victims via social engineering tactics. The domain remains operational despite its malicious intent, posing a significant risk to individuals encountering it through phishing vectors. Infrastructure analysis reveals the domain is hosted on GitHub Pages, a legitimate static site hosting service, and resolves to the IP address 185.199.108.153. The domain is flagged by 9 of 95 security vendors on VirusTotal, indicating a moderate but concerning detection rate. The SSL certificate is issued by Let's Encrypt, a common practice among threat actors to lend legitimacy to malicious sites. Technologies detected include Varnish, GitHub Pages, and Fastly, which are consistent with the hosting environment but do not inherently indicate malicious activity. The domain is registered through GitHub, Inc., and no creation date is publicly disclosed for GitHub Pages subdomains, limiting temporal attribution. The current status of tatendahjames-glitch.github.io remains active, with no evidence of takedown or mitigation at the time of analysis. The risk level is assessed as high due to the domain's operational status and its direct targeting of user credentials. Organizations and individuals are advised to block access to the domain at the network level and update endpoint protection rules to include this indicator of compromise. Security teams should monitor for related GitHub Pages subdomains, as threat actors frequently rotate infrastructure within the same hosting environment. Users who may have interacted with the domain are urged to reset credentials immediately and enable multi-factor authentication on all accounts.