shyam-ramani[.]github[.]io

This domain, shyam-ramani.github.io, is actively engaged in credential theft operations, designed to deceive users into submitting sensitive login credentials through fraudulent web pages. Analysis indicates the site mimics legitimate services, leveraging social engineering tactics to trick victims into entering usernames, passwords, and other personally identifiable information (PII). The infrastructure is hosted on GitHub Pages, a common tactic to exploit trusted platforms for malicious purposes, while the domain itself is crafted to appear authentic at first glance. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain is flagged by 16 out of 95 security vendors on VirusTotal, a significant threshold for malicious classification. It appears on two independent security blocklists, including PhishDestroy and PhishingDB, further corroborating its fraudulent nature. Registered through GitHub, Inc., the domain resolves to the IP address 185.199.108.153, located in the United States, and was created on April 07, 2026—an anomalous future date suggesting potential domain spoofing or registry manipulation. The SSL certificate, issued by Let's Encrypt (R12), provides encryption but does not validate the legitimacy of the site, as certificates are routinely issued to malicious actors. Users who have visited shyam-ramani.github.io or interacted with its content should take immediate remediation steps. First, terminate any active sessions with the domain and clear browser caches to remove residual tracking elements. If credentials were entered, reset passwords for all associated accounts, prioritizing email, financial, and administrative services. Enable multi-factor authentication (MFA) where available to mitigate unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or transactions, and report the domain to relevant security teams for further investigation. Given the high-risk classification and active status, avoid all interaction with this domain and exercise caution with similar GitHub-hosted pages.