anjas2005[.]github[.]io

PhishDestroy identifies anjas2005.github.io as a high-risk fake-login phishing domain still active as of today. The page mimics an official login portal to harvest credentials, with SSL certificate issued by Let’s Encrypt to appear legitimate. Traffic is served from GitHub Pages infrastructure at 185.199.108.153, which is known to host both benign content and malicious landing pages. This combination is leveraged by threat actors to bypass traditional email filters and social-engineering defenses. This domain was flagged by 5 of 95 VirusTotal security vendors, indicating moderate but not universal detection coverage. It is registered through GitHub, Inc. and resolves to IP 185.199.108.153. The page is served over HTTPS with a valid Let’s Encrypt certificate, increasing the appearance of authenticity. The active campaign uses GitHub Pages to evade takedowns, relying on the platform’s global CDN and reputation for benign hosting. The high risk stems from the persistent availability and the credential-harvesting objective, which can lead to immediate account compromise if users enter credentials. To mitigate exposure, users should avoid clicking links to anjas2005.github.io and treat any emails referencing it as suspicious. Organizations should block the domain at DNS and proxy layers and monitor for outbound connections to 185.199.108.153 on ports 80 and 443. If credentials were entered, advise password resets and enable multi-factor authentication on the affected accounts immediately. The campaign continues to evolve, so continuous monitoring and threat-intel sharing are recommended to prevent follow-on attacks.