blueveiw-file[.]github[.]io

This domain, blueveiw-file.github.io, operates as a credential theft portal designed to harvest user login credentials under the guise of a document-viewing service. The page title 'View Document' suggests an attempt to mimic legitimate file-sharing platforms, a common tactic in credential harvesting campaigns. Analysis indicates the site likely targets corporate or personal users expecting document access, tricking them into entering sensitive credentials on a fraudulent interface. The threat extends beyond immediate data exposure, as compromised credentials may enable further unauthorized access to connected accounts, including email, cloud storage, or financial services. Infrastructure analysis reveals the domain is hosted on GitHub Pages, registered through GitHub, Inc., and resolves to the IPv6 address 2606:50c0:8002::153, associated with AS54113 (Fastly, Inc.) in the United States. The site employs a Let's Encrypt SSL certificate (R12), providing a false sense of security to visitors. Detection metrics confirm its malicious nature: 10 out of 95 security vendors on VirusTotal flag the domain as malicious, and it appears on at least one security blocklist. The domain remains active as of this report, with no evidence of takedown or mitigation efforts by the hosting provider. Users who visited blueveiw-file.github.io should immediately assume their credentials may have been compromised. Affected individuals must change passwords for any accounts accessed after visiting the site, prioritizing accounts with elevated privileges or financial access. Enable multi-factor authentication (MFA) on all critical services to mitigate further risk. Security teams should monitor for anomalous login attempts or unauthorized access originating from the same IP range (2606:50c0:8000::/34). If browser sessions were active during the visit, clear all cached data and revoke any active tokens or cookies associated with the affected accounts. Organizations should block the domain and its resolving IP at the network perimeter to prevent further exposure.