ruki77[.]github[.]io

PhishDestroy identifies ruki77.github.io as an active credential harvesting scam posing an elevated risk to unsuspecting visitors. This GitHub-hosted domain deploys spoofed login pages to trick users into surrendering sensitive credentials, directly mirroring the tactics of modern phishing campaigns. The site masquerades as a legitimate service while silently exfiltrating harvested data to attacker-controlled servers, making it a high-consequence threat to user privacy and financial security. This domain was flagged by 13 out of 95 VirusTotal security vendors, confirming its malicious intent. It is registered through GitHub, Inc., resolving to the IP address 185.199.108.153, which is associated with dynamic and frequently abused infrastructure. The use of a Let's Encrypt SSL certificate adds superficial legitimacy, but the absence of reputable trust indicators and presence on multiple threat intelligence blocklists underscore its fraudulent nature. The combination of low detection coverage by security vendors and the abuse of a trusted hosting platform like GitHub amplifies the risk, as users may lower their guard when encountering familiar domains. To mitigate exposure to this credential harvesting scam, users must avoid interacting with ruki77.github.io entirely. If credentials or sensitive data were inadvertently entered, immediately rotate passwords across all accounts using a unique, complex passphrase and enable multi-factor authentication. Organizations should block the domain at the network perimeter and alert users through security awareness training. GitHub must be notified of abuse to expedite takedown, as the platform’s reputation is being exploited for fraudulent gain. Sharing threat intelligence with industry peers strengthens collective defense against similar campaigns leveraging reputable infrastructure. Remain vigilant: any unsolicited request for login credentials via this domain is malicious and must be reported and ignored.