madhaavvvv[.]github[.]io

PhishDestroy identifies madhaavvvv.github.io as an active credential-harvesting page posing as a GitHub login portal. The site is engineered to trick visitors into submitting usernames and passwords that are immediately exfiltrated to attacker-controlled servers. Once harvested, stolen credentials are typically reused against high-value targets or sold on underground forums within hours of collection.

This domain was flagged by 14 out of 95 VirusTotal security vendors and is served from IP 185.199.108.153 via a Let’s Encrypt certificate. It was registered through GitHub, Inc., indicating no traditional WHOIS record is publicly available, a common tactic used to delay takedown efforts and obscure true ownership. The combination of legitimate hosting (GitHub Pages) and low detection initially lowers user suspicion, increasing the chance of successful compromise.

If you visited madhaavvvv.github.io, assume credentials entered were compromised. Immediately rotate all passwords used on that page, enable two-factor authentication on every account, and scan local devices with updated antivirus software. Report any suspicious logins to the relevant service provider and consider revoking GitHub OAuth tokens linked to the affected account. Monitor financial and email accounts for signs of secondary compromise over the next 30 days.