shreyagupta45[.]github[.]io

PhishDestroy identifies shreyagupta45.github.io as a high-risk credential theft domain actively harvesting user login details. Hosted on GitHub Pages, this phishing site resolves to IP 185.199.110.153 and presents a Let's Encrypt SSL certificate to appear legitimate. Security vendors are increasingly detecting the threat, with 5 out of 95 engines on VirusTotal currently flagging the domain as malicious. GitHub, Inc. serves as the registrar, and the domain remains in active status with no evidence of suspension. Historical analysis shows this infrastructure has been leveraged to mimic trusted services, increasing the likelihood of successful deception among unsuspecting users.

Technical indicators reinforce the elevated risk profile. The domain’s IP address 185.199.110.153 aligns with GitHub’s Pages infrastructure, but the specific subdomain shreyagupta45 demonstrates a pattern of abuse involving credential harvesting campaigns. The use of a valid SSL certificate via Let's Encrypt (common among phishing actors to bypass browser security warnings) further enhances the domain’s deceptive appearance. With 5/95 detection coverage—indicating low but growing recognition by security tools—this domain remains under the radar for many users and even some automated defenses. Its ongoing accessibility and association with GitHub’s trusted platform increase the potential for successful compromise, particularly among users accustomed to assuming GitHub Pages content is safe.

To mitigate exposure to this credential theft threat, users should immediately avoid accessing shreyagupta45.github.io and verify any links received via email or messaging platforms before clicking. Enable multi-factor authentication (MFA) on all critical accounts and use password managers that detect and block known phishing domains. Organizations should update blocklists with this domain (seed 7bb1d1) and share threat intelligence with security teams. Monitor DNS and proxy logs for connections to 185.199.110.153 or related GitHub Pages IPs. Report the domain to GitHub Trust & Safety via their abuse reporting form and to threat intelligence platforms like VirusTotal to accelerate detection across the community.