renjith-baby[.]github[.]io

PhishDestroy identifies renjith-baby.github.io as an active credential theft domain posing a high risk to users. The domain is engaged in capturing login credentials through deceptive means, leveraging social engineering tactics. There is no indication of brand impersonation, but the threat is generic phishing aimed at credential harvesting.

This domain resolves to IP address 185.199.108.153 and is registered through GitHub, Inc., utilizing a Let's Encrypt SSL certificate. VirusTotal analysis flags 18 out of 95 security vendors for malicious activity associated with this domain. Additionally, Google Safe Browsing categorizes it under the SOCIAL_ENGINEERING threat type. The domain is hosted on infrastructure commonly used for static content delivery but is abused here for malicious purposes. The domain is actively flagged on multiple blocklists, reinforcing its high-risk classification.

The current status remains active, and users should exercise extreme caution to avoid credential disclosure. Immediate recommendations include blocking this domain via network controls, updating endpoint protection signatures, and educating users about the risks of interacting with unknown GitHub-hosted pages requesting sensitive information. Reporting the domain to security platforms and maintaining vigilance against similar credential theft campaigns is critical to mitigating potential harm.