cse23r01a05cq[.]github[.]io

This domain, cse23r01a05cq.github.io, is actively hosting a credential harvesting phishing page designed to mimic legitimate login portals. Analysis indicates the site targets users by presenting fraudulent authentication forms, likely impersonating corporate or cloud service providers to capture usernames, passwords, and potentially multi-factor authentication tokens. The infrastructure leverages GitHub Pages, a legitimate hosting service, to evade initial suspicion and blend in with benign traffic patterns. Evidence confirms the domain is flagged by 15 out of 95 security vendors on VirusTotal, with one additional entry on a security blocklist. The domain is registered through GitHub, Inc., and resolves to the IP address 185.199.108.153, a known GitHub Pages endpoint. The SSL certificate is issued by Let's Encrypt (R12), providing a false sense of security to unsuspecting visitors. Despite its benign hosting origin, the domain exhibits high-risk indicators consistent with credential theft campaigns. Users who have visited cse23r01a05cq.github.io or entered credentials on the site should immediately revoke any submitted passwords and enable multi-factor authentication on all associated accounts. Monitor financial and identity-related services for unauthorized activity, as stolen credentials may be exploited for further compromise. Network administrators should block the domain and its resolving IP at the perimeter, and review logs for connections to 185.199.108.153. If browser sessions were active during the visit, clear cached data and run a full antivirus scan to detect potential malware or session hijacking artifacts.