sayakbose26-cpu[.]github[.]io

This domain, sayakbose26-cpu.github.io, operates as a phishing page designed to impersonate a legitimate document viewer or file-sharing service. The site presents itself as a generic 'Document' page, likely tricking users into entering sensitive credentials such as login details, corporate passwords, or financial information under the guise of accessing restricted content. The threat actor behind this campaign leverages the appearance of legitimacy, using a GitHub-hosted subdomain to evade initial suspicion and bypass basic security filters. Analysis indicates the domain is actively malicious, with 13 out of 95 security vendors on VirusTotal flagging it as phishing. The page resolves to the IP address 185.199.108.153, hosted under AS54113 (Fastly, Inc.), a network frequently used for content delivery but also abused for malicious infrastructure. The SSL certificate is issued by Let's Encrypt (R12), a common tactic to appear secure while engaging in fraud. The domain is registered through GitHub, Inc., and despite its benign registration source, it appears on one security blocklist and is confirmed as active by Google Safe Browsing. No legitimate business or service is associated with this subdomain, reinforcing its fraudulent nature. Users who have visited sayakbose26-cpu.github.io should take immediate action to mitigate risk. First, disconnect the device from the network to prevent potential data exfiltration. Scan the system using updated antivirus software to detect and remove any malware or backdoors. Reset all credentials entered on the site, prioritizing email, banking, and corporate accounts. Enable multi-factor authentication (MFA) where available to add an additional layer of security. Monitor financial statements and account activity for unauthorized transactions. If the device was used for work, report the incident to the organization’s security team for further investigation and containment. Avoid interacting with the domain or any links associated with it, as it remains active and poses a continued threat.