ridhi0187[.]github[.]io

PhishDestroy has identified ridhi0187.github.io as a high-risk threat, classified as a generic phishing domain. This site is actively being used to deceive visitors, likely aiming to steal sensitive credentials or personal information through fraudulent pages hosted on GitHub Pages. The domain remains live and accessible, posing an ongoing risk to users who may encounter it via email links or malicious redirects.

Analysis reveals several concerning indicators. VirusTotal flags this domain with 4 out of 95 security vendors detecting malicious activity. The domain was registered through GitHub, Inc. on March 26, 2026, and resolves to IP address 185.199.110.153, which is associated with GitHub's content delivery network. It appears on one security blocklist, and the page title displays a default GitHub Pages "Site not found" message, suggesting the phishing content may be hosted on a subpage or served dynamically. An SSL certificate from Let's Encrypt (R12) provides encryption, which can give users a false sense of security.

To protect against this threat, users and organizations should block the domain and IP at the network level. Since this is a generic phishing site, avoid clicking any links or entering credentials on pages associated with this domain. Enable multi-factor authentication on all accounts and report the domain to GitHub's abuse team for takedown. Regularly monitor for similar domains using pattern-based detection to prevent future incidents.