khushikumari-6228[.]github[.]io

This domain, khushikumari-6228.github.io, is actively engaged in credential theft operations, designed to harvest user login credentials through deceptive landing pages. Analysis indicates the infrastructure is hosted on GitHub Pages, a common tactic to exploit legitimate cloud services for malicious purposes. The domain presents itself as a benign or non-existent page (e.g., 'Site not found'), but historical snapshots and telemetry confirm it previously served phishing content targeting email, social media, or financial accounts. The threat actor likely leverages the GitHub Pages platform to evade detection and reduce hosting costs, while dynamically rotating content to avoid automated takedowns. Evidence supporting this assessment includes detection by 15 out of 95 security vendors on VirusTotal, with the domain listed on two independent security blocklists. The SSL certificate is issued by Let's Encrypt (R12), a common choice for phishing sites due to its free and automated issuance process. The domain resolves to the IP address 185.199.108.153, which is part of GitHub, Inc.'s infrastructure located in the United States. Google Safe Browsing has explicitly flagged this domain as phishing, further corroborating its malicious intent. The registrar is GitHub, Inc., and while the current page title displays 'Site not found,' this is likely a temporary state to evade scrutiny while the infrastructure remains active. Users who have visited khushikumari-6228.github.io or interacted with its content should take immediate action to mitigate potential compromise. First, reset passwords for any accounts accessed while the domain was active, prioritizing email, financial, and administrative accounts. Enable multi-factor authentication (MFA) on all critical services to prevent unauthorized access. Review browser history and stored credentials for signs of exposure, and clear cached data to remove any residual artifacts. If credentials were entered, monitor linked accounts for suspicious activity, such as unauthorized logins or transactions. Organizations should update their web filtering rules to block this domain and its associated IP address, and conduct internal investigations to identify any affected users or systems. Given the high-risk nature of this threat, proactive measures are essential to prevent further exploitation.