sure-chandini[.]github[.]io

PhishDestroy identifies active phishing infrastructure on sure-chandini.github.io, a GitHub-hosted domain linked to a generic phishing campaign. The domain resolves to IP 185.199.108.153 and was registered via GitHub, Inc., leveraging a Let's Encrypt SSL certificate for credibility. No specific brand or drainer kit has been explicitly tied to this campaign yet, but the generic nature suggests opportunistic credential harvesting or fraudulent transactions. The threat remains under investigation as analysts assess potential payloads and targeted decoy content.

Technical indicators confirm the following: VirusTotal detection rate is 5/95, indicating a fully undetected threat as of the latest scan. The domain was registered through GitHub, Inc., resolving to static IP 185.199.108.153. Google Safe Browsing (GSB) status shows no current blocklisting, and no external blocklists have flagged this domain. These attributes—combined with GitHub’s legitimate hosting framework—create a deceptive environment that masks malicious intent behind a trusted domain.

Current status of the campaign is active, though the risk level is still under investigation due to limited payload visibility. PhishDestroy has flagged the domain and initiated monitoring for domain behavior anomalies, SSL certificate rotation, or shifts in hosting infrastructure. Immediate risk remains moderate due to low detection rates and GitHub’s trusted reputation. Users are advised to avoid interacting with links or forms on sure-chandini.github.io and report any observed suspicious activity. Remaining risk could escalate if this domain is weaponized against broader audiences or integrates obfuscated JavaScript payloads in future iterations.