shirosan313[.]github[.]io

This domain presents a high-risk phishing threat designed to harvest GitHub login credentials. Visitors are redirected to a counterfeit GitHub authentication page that mimics the legitimate interface, capturing usernames and passwords entered by unsuspecting users. The site may also attempt to collect multi-factor authentication codes or session tokens, enabling account takeovers and unauthorized access to private repositories or organizational resources. Analysis indicates the domain is hosted on GitHub Pages infrastructure, resolving to IP address 185.199.108.153. It uses a Let's Encrypt SSL certificate to appear legitimate, though 14 out of 95 security vendors on VirusTotal have flagged the domain as malicious. The domain remains active, with Google Safe Browsing categorizing it under SOCIAL_ENGINEERING. Registration details confirm it was created through GitHub, Inc., a common tactic to evade initial suspicion due to the platform's trusted reputation. If you visited shirosan313.github.io and entered credentials, immediately revoke all active GitHub sessions and reset your password using a secure device. Enable multi-factor authentication if not already active, and review recent account activity for unauthorized changes or access. Check connected third-party applications and revoke permissions for any unrecognized services. Organizations should audit repository access logs for signs of compromise and rotate any exposed secrets or API keys. Report the incident to GitHub support and monitor for phishing attempts via email or other channels.