gokul-unni93[.]github[.]io

gokul-unni93.github.io is an active credential-harvesting scam hosted on GitHub Pages at IP 185.199.108.153 under the Let's Encrypt SSL certificate. VirusTotal currently records 0 detections across 95 engines, indicating the page remains largely undetected by antivirus platforms. PhishDestroy identifies this site as part of a broader campaign leveraging free GitHub.io subdomains to mimic legitimate login interfaces and steal user credentials; the page has been tagged under_investigation and is confirmed active.

This domain was flagged via seed 6b483e and is registered through GitHub, Inc. The underlying server resolves to 185.199.108.153, a known GitHub Pages IP range. Despite zero VirusTotal detections at the time of analysis, the page’s purpose is to mimic trusted login portals, posing a direct risk of credential theft and subsequent account compromise. There are no current entries in major blocklists such as PhishTank or OpenPhish, and the domain lacks historical trust signals, reinforcing its malicious intent.

Users encountering this site should immediately cease interaction and avoid entering any login credentials. Report the domain to your email provider, browser vendor, and security teams. Organizations are advised to block 185.199.108.153 and the domain at the network perimeter. If credentials were entered, rotate passwords immediately, enable multi-factor authentication where possible, and monitor for signs of account takeover or fraudulent activity.