manikshan-foreign-employment[.]github[.]io

This domain, manikshan-foreign-employment.github.io, is confirmed as a high-risk fake login portal designed to harvest user credentials. Analysis indicates the page mimics legitimate authentication interfaces, presenting a deceptive 'Secure Login' title to lure victims into submitting sensitive information. The threat aligns with credential phishing tactics, where attackers impersonate trusted services to extract login details for subsequent unauthorized access or financial fraud. Infrastructure analysis reveals the domain is hosted on GitHub Pages infrastructure, registered through GitHub, Inc., and resolves to the IPv6 address 2606:50c0:8000::153, associated with AS54113 (Fastly, Inc.) in the United States. Detection metrics show 7 out of 95 security vendors on VirusTotal have flagged the domain, while it appears on at least one security blocklist. The SSL certificate is issued by Let's Encrypt (R12), a common practice among threat actors to lend superficial legitimacy to phishing sites. Despite these indicators, the domain remains active and unmitigated as of the latest verification. To mitigate risks associated with this fake login portal, organizations and users should immediately block access to the domain at the network level and update endpoint protection rules to prevent interaction. Security teams are advised to monitor for credential submission attempts originating from this domain and reset any potentially compromised accounts. Given the use of GitHub Pages, defenders should also review logs for other subdomains under github.io exhibiting similar patterns, as threat actors frequently rotate infrastructure within this namespace. User awareness training should emphasize scrutinizing login page URLs, particularly those hosted on free subdomain services, and verifying SSL certificates beyond the presence of HTTPS.