roopansh123[.]github[.]io

This domain is flagged as a high-risk credential theft operation targeting users through deceptive login portals. Analysis indicates the site is designed to harvest authentication credentials by impersonating legitimate services, likely leveraging GitHub Pages' trusted infrastructure to evade initial suspicion. Infrastructure analysis reveals the domain roopansh123.github.io is registered through GitHub Pages and resolves to IP 185.199.109.153, hosted on AS54113 (Fastly, Inc.) in the US. The SSL certificate is issued by Let's Encrypt (R12), a common tactic to appear legitimate. VirusTotal reports 7/95 security vendors flagging this domain, while PhishDestroy has added it to their blocklist. The page currently displays a 'Site not found' title, suggesting either a placeholder or a cloaking mechanism to avoid detection during initial scans. Mitigation requires immediate blocking of the domain and its resolving IP across network security controls. Organizations should monitor for credential reuse attempts from harvested data, particularly targeting GitHub or other development platforms. Endpoint detection should prioritize alerts for connections to 185.199.109.153 or domains under github.io exhibiting similar cloaking behavior. User awareness training should emphasize verifying GitHub Pages URLs before entering credentials, as this domain exploits the platform's inherent trust.