kv-nandhu[.]github[.]io

This domain, kv-nandhu.github.io, is actively engaged in credential theft phishing operations. Analysis indicates the site presents fraudulent login interfaces designed to mimic legitimate services, tricking users into submitting usernames, passwords, and other sensitive authentication details. The harvested credentials are typically exploited for unauthorized account access, financial fraud, or further targeted attacks against compromised individuals or organizations. Infrastructure analysis reveals the domain is hosted on GitHub Pages (registered through GitHub, Inc.) and resolves to the IP address 185.199.108.153, located in the United States under AS54113 (Fastly, Inc.). The SSL certificate is issued by Let's Encrypt (R12), a common practice among malicious actors to lend false legitimacy. Detection data shows the domain is flagged by 8 out of 95 security vendors on VirusTotal, with one active blocklist (PhishDestroy) listing it as malicious. No historical registration data suggests recent creation, aligning with typical phishing campaign timelines. Users who have visited kv-nandhu.github.io or entered credentials on the site should immediately take remedial action. Reset passwords for all accounts accessed from the same device or network, prioritizing email, financial, and work-related services. Enable multi-factor authentication (MFA) where available to mitigate unauthorized access. Scan the device for malware using updated security tools, as phishing sites often deploy additional payloads. Report the incident to organizational security teams or relevant authorities to assist in broader threat mitigation efforts. Monitor accounts for suspicious activity, including unauthorized logins, transactions, or password reset attempts.