gauravprajapati03[.]github[.]io

This domain, gauravprajapati03.github.io, is flagged for credential theft activity targeting unsuspecting users. Analysis indicates the site was designed to harvest login credentials, likely through deceptive login portals or fake authentication prompts. The infrastructure leverages GitHub Pages hosting, a common tactic to exploit trusted cloud platforms for malicious purposes, while evading traditional detection mechanisms through rapid deployment and takedown cycles.

Infrastructure analysis reveals concrete indicators of compromise. The domain resolves to IP address 185.199.108.153, registered through GitHub, Inc., with a creation date of April 15, 2026—an anomalous timestamp suggesting potential domain spoofing or backdating. It appears on one security blocklist and is flagged by 16 out of 95 security vendors on VirusTotal, including detections for malicious or phishing-related activity. The SSL certificate, issued by Let's Encrypt (R12), provides encryption but does not validate legitimacy, as threat actors frequently abuse free certificate authorities to lend credibility to fraudulent sites.

Users who visited gauravprajapati03.github.io should take immediate remedial action. If credentials were entered, reset passwords for all accounts accessed from the same device or network, prioritizing email, financial, and work-related platforms. Scan the device for malware using updated security tools, as credential theft sites often deploy secondary payloads. Monitor accounts for unauthorized activity and enable multi-factor authentication where available. Report the domain to relevant security teams or abuse contacts, such as the hosting provider (GitHub, Inc.), to facilitate takedown efforts and prevent further exploitation.