kalpanab26[.]github[.]io

This domain, kalpanab26.github.io, is identified as an active credential theft phishing site leveraging GitHub Pages infrastructure. Analysis indicates the threat actor deployed a generic phishing framework designed to capture user credentials through fraudulent login portals, though no specific brand impersonation or crypto drainer kit signatures were observed in initial scans. The page title 'Site not found' suggests either a placeholder state, a cloaking mechanism, or a takedown attempt by the hosting provider, though the underlying phishing infrastructure remains operational. Infrastructure analysis reveals the domain resolves to 185.199.111.153, an IP address assigned to AS54113 (Fastly, Inc.) in the United States. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites due to its free and automated issuance process. VirusTotal detection shows 7 out of 95 security vendors flagging this domain, indicating moderate but not universal recognition of the threat. The domain appears on one security blocklist, though it has not been added to Google Safe Browsing as of this report. Registration details confirm GitHub Pages as the hosting platform, with no explicit domain creation date available due to the use of GitHub's subdomain structure. Current status remains active, with the domain still serving phishing content despite partial detection by security vendors. Response actions by the hosting provider appear limited, as the repository or GitHub Pages configuration has not been fully disabled. The remaining risk is classified as high due to the domain's ability to bypass some security filters and the potential for credential harvesting. Users are advised to block the domain at the network level, verify any unexpected login prompts, and report the infrastructure to GitHub's abuse team for takedown. Organizations should monitor for credential reuse attempts from harvested data, particularly if the phishing site impersonated internal or third-party services.