rupeshanand7[.]github[.]io

This domain, rupeshanand7.github.io, is actively engaged in credential harvesting operations leveraging GitHub Pages infrastructure. Analysis indicates the site impersonates legitimate login portals to capture user credentials, likely targeting software developers, cloud service users, or GitHub account holders. The phishing kit deployed on this domain mimics authentication workflows, including OAuth consent screens or repository access prompts, to trick victims into disclosing sensitive account details. Infrastructure analysis reveals the use of GitHub's hosting platform, which provides SSL encryption and reputable IP space, increasing the likelihood of successful deception due to its apparent legitimacy. Evidence supporting the malicious classification includes detection by 11 out of 95 security vendors on VirusTotal, with the domain appearing on at least one security blocklist. The domain was registered on April 15, 2026, through GitHub, Inc., and currently resolves to the IP address 185.199.108.153, a known GitHub Pages endpoint. The SSL certificate is issued by Let's Encrypt (R12), further blending into expected GitHub infrastructure. Despite the page title displaying 'Site not found · GitHub Pages,' historical or cloaked content may still be accessible via direct links or cached payloads, indicating an attempt to evade automated detection while maintaining operational capability. Users who have visited rupeshanand7.github.io or interacted with its content should immediately revoke any active sessions tied to credentials entered on the site. This includes resetting passwords for GitHub, cloud services, or any other accounts accessed during the suspected compromise. Enable multi-factor authentication (MFA) on all critical accounts, particularly those linked to software development or repository management. Monitor account activity for unauthorized access or changes, such as repository modifications, new SSH keys, or unexpected OAuth app permissions. If financial or cryptographic assets are suspected to be at risk, audit transaction histories and revoke any suspicious API keys or tokens. Report the incident to relevant security teams for further analysis and potential takedown coordination.