saurabhtripathiii[.]github[.]io

This domain is identified as an active credential harvesting phishing site targeting users through deceptive login interfaces. Analysis indicates the site mimics legitimate authentication portals to capture usernames, passwords, and potentially multi-factor authentication codes, enabling account compromise and subsequent unauthorized access to sensitive systems or personal data. The threat is particularly insidious due to its hosting on a trusted platform, which may lower user vigilance and increase the likelihood of successful deception. Infrastructure analysis reveals the domain is registered through GitHub, Inc. and resolves to the IP address 185.199.110.153, a known GitHub Pages endpoint. As of the latest assessment, the site remains operational and has been flagged by 4 out of 95 security vendors on VirusTotal, indicating moderate but growing detection coverage. The SSL certificate is issued by Let's Encrypt, providing a veneer of legitimacy while the underlying content remains malicious. The domain's continued activity suggests an ongoing campaign with no signs of takedown or mitigation. Users who have visited saurabhtripathiii.github.io or entered credentials on the site should immediately take corrective action. First, revoke any sessions associated with the compromised account and change passwords for all linked services, prioritizing email, financial, and identity-related platforms. Enable multi-factor authentication if not already active, using app-based or hardware tokens rather than SMS-based methods. Monitor accounts for unauthorized activity, such as unfamiliar logins, password changes, or financial transactions. Report the incident to the affected service providers and consider notifying relevant data protection authorities if sensitive information was exposed. Additionally, scan local devices for malware, as phishing sites may deploy secondary payloads to maintain persistence or exfiltrate data.