bhajipalekaushik-lang[.]github[.]io

PhishDestroy has flagged bhajipalekaushik-lang.github.io as hosting a live credential-harvesting page disguised as a GitHub repository page. When accessed, the site prompts victims to enter credentials under the guise of a legitimate project, with traffic routed via a GitHub Pages subdomain to appear authentic. The attackers have configured a Let's Encrypt SSL certificate and are resolving to IP 185.199.110.153, which is actively serving the phishing content as of this advisory. No antivirus engines on VirusTotal currently flag the domain, highlighting both its novelty and the need for manual blocking by defenders.

This domain was registered through GitHub, Inc. using their Pages service, which allows attackers to leverage the platform’s reputation to lower user suspicion. The domain resolves to a single IP address—185.199.110.153—hosted within GitHub’s infrastructure in their standard Pages range. A total of 9 out of 95 VirusTotal scanners currently detect the domain as malicious, indicating a fresh deployment with minimal prior exposure. While the registrar and SSL issuer appear legitimate, the content hosted is a spoof of a GitHub project page, specifically targeting users expecting to download or authenticate to a software repository.

If you visited bhajipalekaushik-lang.github.io or were prompted to log in, assume your credentials may have been compromised. Do not reuse passwords across services. Immediately change any passwords entered on this site, enable multi-factor authentication (MFA) on all associated accounts, and report the incident to your security team. Consider revoking any OAuth tokens or API keys tied to your account. Monitor for unusual activity in your repositories or linked services, and block the domain and IP 185.199.110.153 at your firewall or DNS level. Forward any captured logs or credentials to your incident response team for further analysis.