rutuja-er01[.]github[.]io

This domain, rutuja-er01.github.io, is currently under investigation for credential theft phishing activity targeting unsuspecting users. Analysis indicates the domain is designed to harvest login credentials by impersonating legitimate services, likely through cloned login portals or fraudulent authentication prompts. The infrastructure leverages GitHub Pages, a common tactic to evade initial detection due to the platform's trusted reputation and free hosting capabilities. Infrastructure analysis reveals the domain resolves to IP address 185.199.108.153, a known GitHub Pages endpoint. The SSL certificate is issued by Let's Encrypt, providing a false sense of security to potential victims. As of the latest scan, VirusTotal reports 0 detections out of 95 engines, indicating no prior flagging by security vendors. The domain remains active and was registered through GitHub, Inc., with no observed blocklist inclusions or historical takedowns. The absence of prior detections and the use of a reputable hosting provider increase the likelihood of successful exploitation. Users who have visited rutuja-er01.github.io or entered credentials on any page hosted under this domain should immediately revoke access to any accounts potentially exposed. Reset passwords using a secure, unrelated device and enable multi-factor authentication where available. Monitor linked accounts for unauthorized activity, including financial transactions or changes to security settings. If browser sessions were active during the visit, clear all stored credentials and cached data. Organizations should add this domain to internal blocklists and conduct retrospective log analysis to identify any prior interactions with the malicious infrastructure.