chanchalkushwaha[.]github[.]io

This domain is flagged as a high-risk credential harvesting operation targeting users through fake login portals hosted on GitHub Pages infrastructure. Analysis indicates the site is designed to mimic legitimate authentication interfaces, tricking victims into submitting usernames, passwords, and potentially multi-factor authentication codes. The threat type aligns with generic phishing but exhibits characteristics of brand impersonation, likely targeting GitHub or other code repository users given the hosting context. Infrastructure analysis reveals the domain chanchalkushwaha.github.io was registered through GitHub, Inc. on April 15, 2026, resolving to IP address 185.199.108.153 located in the United States. The domain appears on one security blocklist and is flagged by Google Safe Browsing as phishing. VirusTotal detection shows 15 out of 95 security vendors marking this domain as malicious. The SSL certificate is issued by Let's Encrypt (R12), and the current page title reads 'Site not found · GitHub Pages,' suggesting either a placeholder or a cloaking mechanism to evade detection during inactive periods. Despite the benign page title, the domain remains active and continues to pose a threat. Mitigation requires immediate blocking of the domain and its associated IP address 185.199.108.153 across all network security controls. Organizations should enforce strict access policies for GitHub Pages domains, particularly those with recent creation dates or unusual naming patterns. End users should be trained to verify URLs before entering credentials, especially on pages hosted under github.io subdomains. Security teams are advised to monitor for credential reuse attempts from harvested data and implement multi-factor authentication enforcement to mitigate account takeovers. Given the domain's persistence and blocklist presence, continuous monitoring for related infrastructure or newly registered lookalike domains is recommended.