vaibhav-hub123[.]github[.]io

This domain, vaibhav-hub123.github.io, operates as a credential harvesting phishing site designed to steal login credentials from unsuspecting users. The site mimics legitimate login portals, tricking visitors into entering sensitive information such as usernames, passwords, or other personal data. Once submitted, this information is captured by threat actors and can be used for unauthorized account access, identity theft, or further malicious campaigns. The site poses a significant risk to individuals and organizations, particularly those unaware of phishing tactics or lacking multi-factor authentication protections. Analysis indicates this domain is hosted on GitHub Pages, a platform often exploited due to its free hosting and trusted infrastructure. The domain resolves to the IP address 185.199.108.153, associated with AS54113 (Fastly, Inc.) in the United States. It is secured with a Let's Encrypt SSL certificate (YR2), which, while providing encryption, does not validate the legitimacy of the site. As of the latest scan, 7 out of 95 security vendors on VirusTotal have flagged this domain as malicious, confirming its phishing nature. The domain appears on at least one security blocklist, though its continued activity suggests evasion of broader detection. The use of GitHub as a registrar further complicates takedown efforts, as the platform requires manual review for abuse reports. If you or someone in your organization has visited vaibhav-hub123.github.io or entered credentials on this site, immediate action is required. First, change the passwords for any accounts accessed or entered on the site, prioritizing email, financial, and work-related accounts. Enable multi-factor authentication (MFA) on all critical services to prevent unauthorized access, even if credentials are compromised. Monitor accounts for suspicious activity, such as unrecognized logins or transactions, and report any anomalies to the respective service providers. If the compromised device is used for work, notify your organization's IT or security team to assess potential risks to corporate systems. Finally, consider running a full antivirus scan on the device to detect any secondary infections or malware that may have been delivered through the phishing site.