durgamamidipalli53-web[.]github[.]io

PhishDestroy identifies durgamamidipalli53-web.github.io as an active credential theft domain designed to impersonate legitimate login portals and harvest sensitive user credentials. This domain leverages GitHub Pages infrastructure to evade traditional detection mechanisms while maintaining plausible deniability through legitimate hosting services. The threat actor employs social engineering tactics to trick victims into entering their login information, which is then exfiltrated to attacker-controlled servers. While no specific brand impersonation was identified in the available intelligence, the domain's structure suggests it may be targeting multiple service providers through generic credential collection mechanisms. This domain was flagged by 16 out of 95 security vendors on VirusTotal, indicating moderate detection across security platforms. The domain is registered through GitHub, Inc. and resolves to IP address 185.199.108.153. The domain carries a valid SSL certificate issued by Let's Encrypt, which may enhance its credibility with potential victims. As of analysis, this domain appears on 1 security blocklist and is actively blocked by OpenPhish. The domain shows recent activity, suggesting ongoing operational status by the threat actor. The technical configuration indicates a sophisticated attempt to blend into legitimate web infrastructure while maintaining operational security through cloud hosting services. As of current analysis, durgamamidipalli53-web.github.io remains an active threat with high risk potential due to its credential theft operation. Users should immediately block this domain at their network perimeter and avoid any interaction with the URL. Organizations are advised to update their threat intelligence feeds with this indicator and conduct security awareness training to prevent credential compromise. The combination of GitHub hosting, valid SSL certificate, and partial detection across security platforms creates a particularly challenging threat that requires layered defense strategies. While the domain remains active, immediate containment through DNS blocking and network segmentation is recommended to prevent credential harvesting incidents.