granthi-manjothkaur[.]github[.]io

This domain, granthi-manjothkaur.github.io, is flagged as an active credential theft operation impersonating Netflix. Analysis indicates the page presents a visually convincing Netflix clone interface designed to harvest user credentials, including email addresses and passwords. The threat actor appears to be leveraging GitHub Pages infrastructure to host the fraudulent content, a tactic increasingly observed in recent credential harvesting campaigns targeting streaming service subscribers. Infrastructure analysis reveals the domain is registered through GitHub, Inc., and resolves to the IP address 185.199.109.153, geolocated within the United States under AS54113 (Fastly, Inc.). The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites due to its accessibility. Detection metrics show the domain is flagged by 13 out of 95 security vendors on VirusTotal, with one confirmed blocklist entry from PhishDestroy. No creation date metadata is available for GitHub Pages subdomains, but the domain remains actively serving malicious content as of this analysis. Current status indicates the credential theft page remains operational, posing an ongoing risk to users who may encounter it through phishing links distributed via email, social media, or malicious advertisements. Response actions should include immediate reporting to GitHub's abuse handling team, as well as submission to additional threat intelligence platforms to expand detection coverage. Users are advised to verify domain authenticity before entering credentials, particularly for streaming services, and to enable multi-factor authentication where available to mitigate the impact of credential compromise.