sharma-12-29[.]github[.]io

This domain, sharma-12-29.github.io, is identified as an active credential harvesting phishing site targeting users through deceptive login interfaces. Analysis indicates the domain is designed to mimic legitimate authentication portals, tricking visitors into submitting sensitive credentials such as usernames, passwords, and potentially multi-factor authentication codes. The threat actor likely leverages the domain to facilitate account takeovers, financial fraud, or unauthorized access to corporate or personal systems. The use of GitHub Pages for hosting adds a layer of perceived legitimacy, increasing the likelihood of successful exploitation against unsuspecting users. Technical evidence confirms the domain's malicious nature. VirusTotal reports 17 out of 95 security vendors flagging sharma-12-29.github.io as malicious, with Google Safe Browsing explicitly categorizing it as a phishing threat. The domain resolves to the IP address 185.199.108.153, associated with GitHub, Inc., and is secured by a Let's Encrypt SSL certificate (R12). Despite the current page title displaying 'Site not found · GitHub Pages,' historical or cloaked content likely exists to facilitate the phishing campaign. The domain was registered through GitHub, Inc., on March 26, 2026, and appears on at least one security blocklist. Infrastructure analysis reveals the domain leverages GitHub's free hosting service, a common tactic to evade detection and reduce operational costs. Users who have visited sharma-12-29.github.io or interacted with its content should take immediate action to mitigate potential risks. If credentials were entered on the site, reset passwords for all associated accounts, prioritizing financial, email, and corporate systems. Enable multi-factor authentication where available to add an additional security layer. Monitor accounts for unauthorized activity, such as unrecognized logins, transactions, or changes to account settings. If the domain was accessed in a corporate environment, report the incident to the internal security team for further investigation and containment. Additionally, consider scanning the device used to access the domain for malware or unauthorized modifications, as phishing sites may deploy secondary payloads.