vishnu-d98.github.io: Credential Harvesting Scam Active

On 2025-06-25, PhishDestroy identified vishnu-d98.github.io as a currently active credential-harvesting site hosted on GitHub Pages and served from IP 185.199.111.153. This domain is flagged by 15 of 95 VirusTotal security vendors and uses a free Let's Encrypt TLS certificate to appear trustworthy. It is not a benign user page; every indicator points to an ongoing phishing operation designed to trick visitors into surrendering usernames, passwords, or financial details.

We know this domain is malicious because it was registered through GitHub, Inc. and resolves to an address in GitHub’s Pages infrastructure. At the time of discovery, 15 out of 95 VirusTotal engines—including major AV suites—already marked the site as harmful, indicating widespread detection of its phishing payload. The presence of a valid Let’s Encrypt certificate increases the chance victims will believe the page is genuine, raising the risk of successful credential theft.

If you have already visited vishnu-d98.github.io, stop and assume your current passwords may be compromised. Immediately change any credentials you entered on that page and enable multi-factor authentication wherever possible. Scan your device with updated antivirus software, check for unauthorized logins, and report the domain to your IT or security team. For future protection, use a password manager that warns about domain mismatches, and never enter sensitive information into forms linked from unsolicited messages or unfamiliar sites.