gitnikit[.]github[.]io

PhishDestroy identifies gitnikit.github.io as an active credential-phishing site designed to steal GitHub login details from unsuspecting users. The page mimics official GitHub interfaces on a GitHub-owned domain (github.io) in order to bypass browser warnings and trick visitors into entering their username and password. Attackers commonly use free GitHub Pages hosting to host login forms that harvest credentials, which are then relayed to attacker-controlled servers or sold on dark-web markets. Because the page looks legitimate and resolves over HTTPS, victims often do not recognize the scam until after credentials are compromised. This domain was flagged for credential phishing on creation and shows zero detections on VirusTotal (5/95 engines as of the latest scan). It is registered through GitHub, Inc., uses a valid Let’s Encrypt SSL certificate, and resolves to IP address 185.199.108.153—all typical choices for phishing campaigns hosted on free or low-cost platforms. The combination of free hosting, HTTPS, and zero antivirus coverage increases the likelihood of successful compromise, especially when paired with promotional messages sent via social media or email. If you visited gitnikit.github.io and entered any login details, assume they have been compromised. Immediately change your GitHub password and enable two-factor authentication. Review recent sign-ins on GitHub’s security log and revoke any unfamiliar sessions or OAuth tokens. Consider enabling GitHub Advanced Security or an enterprise-grade authentication proxy if you manage sensitive repositories. Finally, run a reputable password manager’s breach scan and enable breach alerts to monitor for credential misuse.