nithiksathyan[.]github[.]io

This domain, nithiksathyan.github.io, is actively engaged in a credential theft operation designed to deceive users into submitting login credentials through fraudulent web portals. Analysis indicates the infrastructure mimics legitimate authentication pages, likely targeting corporate, financial, or social media platforms to capture usernames, passwords, and session tokens. The threat extends beyond individual compromise, as stolen credentials may enable further attacks such as account takeovers, lateral movement in networks, or identity fraud. Evidence supporting this assessment includes detection by 11 out of 95 security vendors on VirusTotal, with signatures identifying the domain as malicious. The domain is hosted on GitHub Pages infrastructure, resolving to the IP address 185.199.108.153, and uses a Let's Encrypt SSL certificate (R12) to lend an appearance of legitimacy. While the domain is registered through GitHub, Inc., it appears on at least one security blocklist and is actively flagged by enterprise-grade threat intelligence feeds. No historical registration data suggests a recent or ephemeral deployment, increasing the likelihood of ongoing malicious activity. Users who have visited nithiksathyan.github.io or interacted with its content should immediately revoke any entered credentials, particularly for sensitive accounts such as email, banking, or corporate systems. Enable multi-factor authentication (MFA) on all accounts as a compensatory control. Network administrators should block the domain and its resolving IP (185.199.108.153) at the perimeter, and monitor for signs of credential reuse or unauthorized access. If browser sessions were active during the visit, clear cached data and review installed extensions for unauthorized modifications. Report the incident to internal security teams or relevant authorities for further forensic analysis.