anjisha616[.]github[.]io

This domain, anjisha616.github.io, is actively hosting a credential theft operation designed to harvest usernames, passwords, and other sensitive authentication data. Analysis indicates the site impersonates legitimate login portals, tricking users into submitting credentials that are then transmitted to attacker-controlled infrastructure. The threat extends beyond immediate account compromise, as stolen credentials are frequently reused across multiple platforms, leading to secondary breaches of email, financial, or corporate systems. Infrastructure analysis reveals the domain is registered through GitHub, Inc. and resolves to the IP address 185.199.108.153, hosted within GitHub Pages infrastructure. Despite displaying a 'Site not found' page title, the domain remains active and malicious, with 16 out of 95 security vendors on VirusTotal flagging it as dangerous. The domain appears on one security blocklist, and Google Safe Browsing has explicitly classified it as phishing. The SSL certificate is issued by Let’s Encrypt (R12), a common tactic to lend false legitimacy to malicious sites. Users who have visited anjisha616.github.io should immediately terminate any active sessions and avoid interacting with the site. If credentials were entered, reset passwords for all accounts where the same or similar passwords were used, prioritizing email, banking, and work-related logins. Enable multi-factor authentication (MFA) on all critical accounts to mitigate unauthorized access. Monitor financial statements and account activity for signs of fraudulent transactions. Report the domain to local cybersecurity authorities or the platform used to access it (e.g., browsers, email providers) to aid in broader threat mitigation efforts.