# PhishDestroy domain threat record: rohitmishra-iitm.github.io

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/rohitmishra-iitm.github.io/
Machine-readable companion: https://phishdestroy.io/domain/rohitmishra-iitm.github.io/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-09-15 14:04:00 UTC
- Last availability or vendor check: 2026-10-21 01:14:34 UTC
- Stored record updated: 2026-10-22 14:24:01 UTC
- VirusTotal detections in the stored snapshot: 7/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: spotify

## Stored infrastructure

- Observed IP address: 185.199.110.153
- Registrar in stored WHOIS data: GitHub Pages
- Last stored HTTP status: 404
- Registration date (registry RDAP, github.io): 2013-03-08 19:12:48 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0a528-d883-70e7-bd72-ba652bc49ab1/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/rohitmishra-iitm.github.io
- Certificate Transparency search: https://crt.sh/?q=%25.rohitmishra-iitm.github.io
- Web Archive lookup: https://web.archive.org/web/*/https://rohitmishra-iitm.github.io/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
rohitmishra-iitm.github.io is a phishing page that impersonated Spotify. It used the title "Spotify - Web Player: Music for everyone" to pass as the official streaming player and targeted Spotify listeners. PhishDestroy first flagged it on 2026-09-15, and it went offline the next day, 2026-09-16. When checked again on 2026-10-19, the site was dead and its root returned no content.

How the scam works
A Spotify phishing page copies the look of the Web Player and asks visitors to log in. Some versions also invent a billing or subscription problem to justify the prompt. Anything typed into the form goes straight to the operator, not to Spotify. Stolen logins are used to take over accounts, are resold, or are tried on other services where people reuse the same password. Pages that ask for card details to "restore" a subscription also expose the victim's payment data.

Evidence
Seven of 89 VirusTotal engines flagged the page as of 2026-09-17: alphaMountain.ai, Emsisoft, G-Data, Gridinsoft, Netcraft, Sophos and Webroot. The count is modest, but Netcraft and Sophos both run dedicated phishing feeds, which makes their agreement meaningful. urlscan.io rated the page malicious and detected the Spotify brand on it, which independently confirms the impersonation. PhishDestroy lists the domain on its own blocklist.

Infrastructure
The page was published as a project site on GitHub Pages, a free static hosting service. A setup like this costs nothing, needs no domain purchase and inherits the trust of the github.io name. Traffic was served from Fastly, Inc. in the US, the content delivery network behind GitHub Pages. The page lasted roughly one day after PhishDestroy first saw it, which fits the short lifespan typical of throwaway pages on free hosting.

What to do
If you entered your Spotify login on this page, change your Spotify password right away. Then use Spotify's option to sign out of all devices and change the same password anywhere else you reused it. Turn on two-factor authentication wherever it is offered, starting with the email account linked to Spotify. If you entered card details, ask your bank to block or reissue the card and watch your statements for unfamiliar charges. Defenders should block this hostname and check proxy and email logs for visits around 2026-09-15 and 2026-09-16. They should also report any similar Spotify-themed github.io pages to GitHub for removal.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0a528-d883-70e7-bd72-ba652bc49ab1/
VirusTotal report: https://www.virustotal.com/gui/domain/rohitmishra-iitm.github.io
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=rohitmishra-iitm.github.io
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:18:14 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a0a528-d883-70e7-bd72-ba652bc49ab1.png
  Captured: 2026-09-15 14:04:00 UTC
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/d56e4385-ca53-4315-8bcf-718460a61f35.png
  Captured: 2026-09-15 14:08:59 UTC
  Source report: https://radar.cloudflare.com/scan/d56e4385-ca53-4315-8bcf-718460a61f35
  SHA-256: 945c4699741e079455940b39652bded28d3c3ecc2dde09ffe7aaa9f9d3ff0ddc
- URLScan · 2026-09-15: https://screenshots.phishdestroy.io/us/01a0a569-ea4a-745d-a2ac-17280bfa9725.png
  Captured: 2026-09-15 14:13:03 UTC
  Source report: https://urlscan.io/result/01a0a569-ea4a-745d-a2ac-17280bfa9725/
  SHA-256: 6f8cf461abf6f0981fbdf94a9989850c5ea3b679650ebe74f85399fed3922ea9
- URLScan · 2026-09-16: https://screenshots.phishdestroy.io/us/01a0abdf-2422-7128-a690-c2ec48987a91.png
  Captured: 2026-09-16 20:18:49 UTC
  Source report: https://urlscan.io/result/01a0abdf-2422-7128-a690-c2ec48987a91/
  SHA-256: 499db6d89f4b75b112422dddae5d6623ad1e623d83659dc48775fd6c3fe0ab29
- URLScan · 2026-09-23: https://screenshots.phishdestroy.io/us/01a0cc0e-98aa-74fd-abfc-6a156c77810e.png
  Captured: 2026-09-23 02:18:31 UTC
  Source report: https://urlscan.io/result/01a0cc0e-98aa-74fd-abfc-6a156c77810e/
  SHA-256: 499db6d89f4b75b112422dddae5d6623ad1e623d83659dc48775fd6c3fe0ab29

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T00:12:31Z",
        "uuid": "01a0a528-d883-70e7-bd72-ba652bc49ab1",
        "scanned_at": "2026-09-15T13:01:58Z",
        "final_url": "https://rohitmishra-iitm.github.io/spotify-homepage/",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://rohitmishra-iitm.github.io/spotify-homepage/",
                "from": "https://rohitmishra-iitm.github.io/spotify-homepage",
                "status": 301
            }
        ],
        "ip": "185.199.108.153",
        "ptr": "cdn-185-199-108-153.github.com",
        "domains": [
            "cdnjs.cloudflare.com",
            "fonts.gstatic.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "142.251.20.94",
            "142.251.20.95",
            "104.17.25.14",
            "185.199.108.153"
        ],
        "asns": [
            "15169",
            "13335",
            "54113"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "a76acaf4da34131646be1f480dd21bdb2c040798795e5792e11482cfa7968273",
        "tls": {
            "san": [
                "*.github.com",
                "*.github.io",
                "*.githubusercontent.com",
                "github.com",
                "github.io",
                "githubusercontent.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR1",
            "subject": "*.github.io",
            "protocol": "TLS 1.3",
            "valid_to": "2026-10-31T23:38:01Z",
            "valid_from": "2026-08-02T23:38:02Z"
        },
        "domain_age_days": 1,
        "apex_age_days": 1,
        "tls_age_days": 43,
        "tls_valid_days": 89,
        "requests": 22,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 98,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "spotify"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Spotify"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "GitHub.com",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=31556952"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T00:24:13Z",
        "uuid": "d56e4385-ca53-4315-8bcf-718460a61f35",
        "scanned_at": "2026-09-15T14:08:59Z",
        "final_url": "https://rohitmishra-iitm.github.io/",
        "status": 404,
        "history": [
            {
                "url": "https://rohitmishra-iitm.github.io/",
                "status": 404
            }
        ],
        "dom_hash": "35bbdd99a249decabdc93f6b809b030db834533d4d78fe69529a214489fae670",
        "doc_hash": "70d613e3acfba24fd2876fcbacaf639e1e111ef4d54baf70761c47673f37d6a3",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "rohitmishra-iitm.github.io",
                "type": "A",
                "value": "185.199.108.153"
            },
            {
                "name": "rohitmishra-iitm.github.io",
                "type": "A",
                "value": "185.199.110.153"
            },
            {
                "name": "rohitmishra-iitm.github.io",
                "type": "A",
                "value": "185.199.111.153"
            },
            {
                "name": "rohitmishra-iitm.github.io",
                "type": "A",
                "value": "185.199.109.153"
            },
            {
                "name": "rohitmishra-iitm.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8003::153"
            },
            {
                "name": "rohitmishra-iitm.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8000::153"
            },
            {
                "name": "rohitmishra-iitm.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8001::153"
            },
            {
                "name": "rohitmishra-iitm.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8002::153"
            }
        ],
        "dnssec_valid": false,
        "ip": "185.199.108.153",
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "created": "2013-03-08T19:12:48Z",
            "updated": "2026-08-12T09:08:04Z",
            "expires": "2027-03-08T19:12:48Z",
            "nameservers": [
                "ns-692.awsdns-22.net",
                "ns-1622.awsdns-10.co.uk",
                "dns1.p05.nsone.net",
                "dns2.p05.nsone.net",
                "dns3.p05.nsone.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T10:31:19Z",
        "analysis_at": "2026-10-18T22:24:17Z",
        "stats": {
            "timeout": 0,
            "harmless": 49,
            "malicious": 11,
            "suspicious": 0,
            "undetected": 32
        },
        "detections": {
            "ESET": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Webroot": "malicious",
            "Emsisoft": "phishing",
            "Netcraft": "malicious",
            "Gridinsoft": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "registrar": "MarkMonitor Inc.",
        "created": "2013-03-08T19:41:10Z",
        "expires": "2027-03-08T19:12:48Z",
        "updated": "2026-08-12T09:08:04Z",
        "first_seen": "2026-09-14T13:10:57Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "sectigo.com"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.110.153"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8001::153"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8000::153"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "sectigo.com"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.109.153"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "letsencrypt.org"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.111.153"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8003::153"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.108.153"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "letsencrypt.org"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "digicert.com"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8002::153"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "digicert.com"
            }
        ],
        "dns_at": "2026-10-18T22:25:15Z",
        "jarm": "29d3fd00029d29d00041d41d00041d6b5eefa2404a56c2ced79a0d16afe36c",
        "cert": {
            "san": [
                "*.github.com",
                "*.github.io",
                "*.githubusercontent.com",
                "github.com",
                "github.io",
                "githubusercontent.com"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "6a65e5d3279ba564a4de74eb5d64478dbb8",
            "sha256": "f2f9a159ce50a0a168b3eaeaf2fced5addd49ba38e2bf63248f057a139fc7856",
            "subject": "*.github.io",
            "valid_to": "2026-12-29T23:44:45Z",
            "valid_from": "2026-09-30T23:44:46Z"
        },
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "registrar_iana_id": "292",
            "registrar_url": "http://www.markmonitor.com",
            "created": "2013-03-08T19:12:48Z",
            "updated": "2025-02-25T20:53:31Z",
            "expires": "2027-03-08T00:00:00Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited",
                "clientUpdateProhibited"
            ],
            "nameservers": [
                "dns1.p05.nsone.net",
                "dns2.p05.nsone.net",
                "dns3.p05.nsone.net",
                "ns-1622.awsdns-10.co.uk",
                "ns-692.awsdns-22.net"
            ],
            "dnssec": "unsigned"
        }
    }
}
```