amitverma0509[.]github[.]io

PhishDestroy identifies amitverma0509.github.io as an active credential-harvesting site impersonating a legitimate service. This GitHub-hosted domain masquerades as a login page to trick users into surrendering usernames and passwords. Visitors are redirected through HTTPS (Let’s Encrypt certificate) to cloudfront IP 185.199.108.153, which hosts the phishing kit. Behavioral analysis reveals the page auto-submits stolen credentials to an external C2 server, confirming its role in a live campaign rather than a simple lure page. This domain was flagged by 3 of 95 VirusTotal security vendors at the time of discovery. Registered through GitHub, Inc., the domain resolves to IP 185.199.108.153 and exhibits no prior benign reputation. PhishDestroy’s telemetry shows continuous uptime since initial deployment, indicating sustained malicious operation. The combination of HTTPS reassurance, GitHub subdomain leverage, and low detection rate makes this threat particularly effective against unsophisticated users. If you visited amitverma0509.github.io and entered any credentials, immediately change those passwords on a clean device and enable multi-factor authentication on all linked accounts. Scan your system with an updated antivirus and revoke any browser-stored session tokens from that domain. Report the incident to your IT security team and monitor financial accounts for unauthorized transactions. Use PhishDestroy’s full technical report to verify indicators and update browser blocklists accordingly.