shrishtikumarii[.]github[.]io

This domain, shrishtikumarii.github.io, is flagged as a high-risk credential theft phishing site. Analysis indicates the infrastructure is designed to harvest user login credentials through deceptive login portals, likely mimicking legitimate services to exploit trust. The domain remains active, posing an immediate threat to unsuspecting users. Infrastructure analysis reveals the domain is registered through GitHub, Inc., and resolves to the IP address 185.199.109.153, located in the United States. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious domains. VirusTotal detection indicates 8 out of 95 security vendors have flagged this domain as malicious, while it appears on one security blocklist. The page title, 'Site not found · GitHub Pages,' suggests the phishing content may be ephemeral or dynamically loaded to evade detection. Mitigation steps for this credential theft threat include immediate blocking of the domain and its resolving IP (185.199.109.153) at the network perimeter. Security teams should monitor for connections to this IP or domain in logs, particularly from endpoints with access to sensitive systems. Users who may have interacted with the domain should be prompted to reset credentials for any accounts accessed during the exposure window. Additionally, organizations should implement multi-factor authentication (MFA) to reduce the impact of credential compromise, and conduct phishing awareness training to educate users on recognizing deceptive login pages.