divyapatilx[.]github[.]io

This domain, divyapatilx.github.io, is actively engaged in credential harvesting phishing operations. Analysis indicates the infrastructure is designed to impersonate legitimate login portals, tricking users into submitting sensitive credentials such as usernames, passwords, and multi-factor authentication codes. The domain leverages GitHub Pages, a free hosting service, to deploy phishing kits that closely resemble corporate or financial institution login pages, increasing the likelihood of successful compromise. Evidence supporting this assessment includes detection by 12 out of 95 security vendors on VirusTotal, indicating a high-confidence malicious classification. The domain was registered through GitHub, Inc. on April 04, 2026, and currently resolves to the IP address 185.199.108.153, which is associated with GitHub’s hosting infrastructure in the United States. Additionally, the domain appears on one security blocklist, further corroborating its malicious intent. The SSL certificate is issued by Let’s Encrypt (R12), providing a veneer of legitimacy while facilitating encrypted phishing traffic. Users who have visited divyapatilx.github.io or entered credentials on any page hosted under this domain should take immediate action. First, revoke any active sessions on accounts that may have been exposed and change passwords using a secure, unrelated device. Enable multi-factor authentication if not already active, and monitor accounts for unauthorized access or transactions. If corporate credentials were entered, notify the organization’s security team to initiate incident response protocols. Finally, scan the device used to access the domain for malware, as phishing pages may deploy additional payloads.