harshamreliya1348[.]github[.]io

This domain, harshamreliya1348.github.io, is flagged as a credential theft operation targeting users through deceptive login portals. Analysis indicates no direct association with a specific brand or drainer kit, but the infrastructure aligns with common phishing tactics used to harvest usernames, passwords, and session tokens. The domain lacks overt branding, suggesting a generic or opportunistic campaign rather than a targeted impersonation of a well-known service. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 185.199.108.153 and was created on June 15, 2026, though this date may reflect GitHub Pages' automated registration rather than attacker-controlled timing. It appears on one security blocklist and is flagged by 7 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Let's Encrypt (R12), and the domain is currently hosted through GitHub, Inc. The page title, 'Site not found · GitHub Pages,' may indicate a placeholder or a recently deactivated phishing page, though the domain remains active. Current status shows the domain is still operational, though the visible content does not match typical phishing page behavior. Users and network defenders are advised to block traffic to this domain at the DNS or network level, as residual risk persists due to its presence on security blocklists and vendor detections. Monitoring for renewed activity or updated content is recommended, as GitHub Pages domains can be rapidly repurposed for malicious campaigns. No direct financial drainer or cryptocurrency wallet identifiers were observed in the available data.