ankitprajapati999[.]github[.]io

PhishDestroy identifies ankitprajapati999.github.io as a high-risk credential theft scam operating under the guise of a legitimate service. The domain leverages GitHub Pages to host a deceptive interface designed to harvest user credentials under false pretenses, likely targeting unsuspecting victims through phishing campaigns or malicious links. No specific brand impersonation is confirmed at this stage, but the threat actor’s primary objective aligns with credential harvesting, a common tactic in financially motivated cybercrime. This domain was flagged by 16 out of 95 VirusTotal security vendors, with Google Safe Browsing classifying it under SOCIAL_ENGINEERING. Registered through GitHub, Inc., the domain resolves to IP address 185.199.108.153 and utilizes a Let’s Encrypt SSL certificate to appear legitimate. While the exact creation date is unverified, the domain’s active status and sustained presence on blocklists indicate ongoing malicious activity. The combination of a high VirusTotal detection rate, GSB flagging, and GitHub-hosted infrastructure underscores the sophistication of the threat actor in evading early detection. As of the latest assessment, ankitprajapati999.github.io remains active and unresolved, posing a persistent risk to users who may encounter it through phishing emails, social media, or compromised websites. GitHub has been notified, and domain takedown requests have been submitted to relevant authorities; however, the threat persists due to the domain’s dynamic infrastructure. Users are strongly advised to avoid interacting with this domain, verify URLs before inputting credentials, and report suspicious activity to their security teams or trusted threat intelligence platforms.