durga-ranakoti-carry[.]github[.]io

The domain durga-ranakoti-carry.github.io is currently active and flagged as a generic phishing threat targeting users through a fake GitHub login interface. Analysis indicates this is not a credential harvester for third-party services but rather a direct impersonation of GitHub's authentication portal, likely designed to capture legitimate platform credentials. The domain remains operational and has not been taken down by the hosting provider. Infrastructure analysis reveals the domain resolves to the IP address 185.199.110.153, geolocated in the United States under AS54113 (Fastly, Inc.). It is registered through GitHub, Inc., leveraging GitHub Pages for hosting, which aligns with the observed impersonation of GitHub services. The SSL certificate is issued by Let's Encrypt (serial number YR2), a common tactic to appear legitimate. As of the latest scan, 5 of 95 security vendors on VirusTotal have flagged this domain as malicious. Additionally, the domain appears on 2 security blocklists, including PhishDestroy and OpenPhish, though it remains accessible. Current status confirms the domain is still active and serving phishing content. Organizations and users are advised to block the domain and its associated IP (185.199.110.153) at the network perimeter. Security teams should monitor for credential reuse attempts, particularly for GitHub accounts, and implement multi-factor authentication (MFA) as a mitigation measure. Given the domain's hosting on GitHub Pages, administrators should review internal policies regarding the use of such services for unauthorized content and consider proactive scanning for similar impersonation attempts.