iitssme1987-bit[.]github[.]io

This domain, iitssme1987-bit.github.io, is actively engaged in credential harvesting operations targeting corporate IT support and internal service desk portals. Analysis indicates the site mimics login interfaces for enterprise IT helpdesks, designed to capture employee credentials under the guise of legitimate support requests. The domain remains operational and continues to host fraudulent content as of the latest verification. Infrastructure analysis reveals the domain is registered through GitHub, Inc., leveraging GitHub Pages for hosting, and resolves to the IP address 185.199.108.153. Security vendors have flagged the domain in 14 of 95 VirusTotal scans, while it appears on one known security blocklist. The SSL certificate is issued by Let's Encrypt, providing a superficial layer of legitimacy. Despite the low blocklist count, the 14.7% detection rate among security vendors underscores a significant risk of malicious intent. Current monitoring confirms the domain remains active and accessible. Organizations are advised to implement immediate network-level blocking at the DNS and IP levels, particularly for 185.199.108.153. Security teams should review logs for connections to this domain or IP, particularly from endpoints accessing internal IT support portals. Employee awareness campaigns should emphasize verification of IT support URLs and the risks of entering credentials into untrusted interfaces. Proactive monitoring for similar GitHub-hosted domains using Let's Encrypt certificates is recommended to mitigate related threats.