toshitgupta2401[.]github[.]io

This domain, toshitgupta2401.github.io, is flagged as a high-risk phishing infrastructure specializing in fake login credential harvesting. Analysis indicates the site impersonates legitimate authentication portals, likely targeting users of cloud services, social media platforms, or financial institutions. No direct evidence of a crypto drainer kit or brand-specific impersonation (e.g., Microsoft, Google, or banking entities) has been confirmed, though the generic login template suggests broad applicability across multiple services. The absence of a branded payload increases the likelihood of opportunistic credential theft rather than targeted attacks. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 185.199.108.153, hosted on autonomous system AS54113 (Fastly, Inc.) in the United States. It is registered through GitHub, Inc., leveraging GitHub Pages for hosting, which aligns with common phishing tactics exploiting free-tier infrastructure. The SSL certificate is issued by Let's Encrypt (R12), providing a veneer of legitimacy. VirusTotal detection metrics show 4 out of 95 security vendors flagging the domain as malicious, a low but non-negligible ratio that suggests either evasion techniques or recent deployment. The domain appears on one enterprise-grade blocklist and is actively blocked by at least one major security provider. No creation date is publicly available, but the use of GitHub Pages implies recent or ephemeral deployment, a hallmark of phishing campaigns. Current status confirms the domain remains active, with no takedown or mitigation observed as of analysis. The hosting provider, GitHub, has not issued a suspension, and the Let's Encrypt certificate remains valid, enabling continued HTTPS access. Response actions for affected users include immediate password resets for any credentials entered on the site, multi-factor authentication (MFA) enforcement, and review of connected sessions or devices. Organizations should add the domain and associated IP (185.199.108.153) to internal blocklists, while end-users are advised to verify URLs via independent sources before authentication. The remaining risk is classified as high due to the domain's persistence, low detection rate, and exploitation of trusted infrastructure, which may bypass basic security controls.