virajahir018[.]github[.]io

This domain, virajahir018.github.io, is identified as an active credential theft operation. Analysis indicates the threat actor is leveraging GitHub Pages infrastructure to host a fraudulent login portal designed to harvest user credentials. While no explicit brand impersonation or cryptocurrency drainer kit signatures were observed, the domain exhibits characteristics consistent with credential harvesting, including obfuscated form submissions and static page elements mimicking legitimate authentication flows. The absence of visible brand assets suggests a generic but highly adaptable attack vector, likely targeting a broad range of services or custom phishing lures distributed via malicious links. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 185.199.108.153, registered under GitHub, Inc., and was created on April 21, 2026. Google Safe Browsing has flagged the domain as phishing, while VirusTotal reports 19 out of 95 security vendors detecting malicious activity. The domain appears on one security blocklist and is currently blocked by at least one threat intelligence feed. The SSL certificate is issued by Let’s Encrypt (R12), and the IP geolocation traces to the United States, consistent with GitHub’s hosting environment. The page title, 'Site not found · GitHub Pages,' may indicate an attempt to evade detection by presenting a benign error state while maintaining malicious backend functionality. As of the latest assessment, the domain remains active and unresolved by the hosting provider. While the visible page title suggests a dormant or misconfigured state, historical telemetry and detection counts confirm ongoing malicious activity. Users and organizations are advised to implement network-level blocking for the domain and associated IP address. Security teams should monitor for credential reuse attempts stemming from this campaign, particularly in environments where GitHub Pages or similar hosting services are permitted. The continued use of legitimate hosting infrastructure underscores the need for layered defenses, including real-time URL inspection and endpoint protection capable of detecting post-exploitation behavior.