saranagam[.]github[.]io

This domain, saranagam.github.io, is confirmed to host credential harvesting phishing pages designed to mimic legitimate login portals. Analysis indicates the infrastructure is actively collecting usernames, passwords, and other sensitive authentication details through fraudulent forms. The domain leverages GitHub Pages for hosting, a tactic observed in recent phishing campaigns to exploit trusted cloud platforms and evade initial detection. Infrastructure analysis reveals the domain was registered through GitHub, Inc. on April 15, 2026, and resolves to the IP address 185.199.108.153. VirusTotal detection metrics show 10 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Let's Encrypt (R12), a common choice for threat actors to establish encrypted connections and appear legitimate. Despite the page title displaying 'Site not found · GitHub Pages,' historical snapshots confirm the presence of active phishing content. Users who have visited saranagam.github.io should immediately revoke any entered credentials, particularly for services the phishing page mimicked. Reset passwords using multi-factor authentication (MFA) where available, and monitor accounts for unauthorized activity. Security teams should block the domain and its resolving IP (185.199.108.153) at the network perimeter, and review logs for connections to the domain or related indicators. If browser sessions were active during exposure, clear cached data and run a full antivirus scan to detect potential malware or persistent threats.