uditrsahani-ship-it[.]github[.]io

This domain, uditrsahani-ship-it.github.io, operates as a credential theft site impersonating Apple support. Visitors are presented with a fraudulent login interface designed to harvest Apple IDs, passwords, and potentially two-factor authentication codes. The page title, 'Contact - Offficial Apple,' deliberately misspells 'Official' to evade basic detection while maintaining the appearance of legitimacy. Such schemes often lead to account takeovers, unauthorized purchases, or further social engineering attacks targeting victims' contacts. Analysis indicates this infrastructure is actively malicious, with 17 out of 95 security vendors on VirusTotal flagging the domain as harmful. The site is hosted on GitHub's infrastructure (AS54113 Fastly, Inc.) and resolves to the IP address 185.199.111.153, a common endpoint for GitHub Pages. The SSL certificate is issued by Let's Encrypt (R12), providing HTTPS encryption that may mislead users into trusting the site. Google Safe Browsing has explicitly marked this domain as phishing, and it appears on at least one security blocklist, including PhishDestroy. The use of GitHub Pages allows the threat actor to rapidly deploy and modify the phishing page while leveraging GitHub's reputation to bypass initial scrutiny. If you or someone you know visited uditrsahani-ship-it.github.io, immediate action is required. First, do not enter any credentials or personal information. If login details were already submitted, change the password for the affected Apple ID and any other accounts using the same credentials. Enable two-factor authentication if not already active, using an authenticator app rather than SMS when possible. Monitor the Apple ID for unauthorized activity, such as unfamiliar purchases or changes to account settings. Report the incident to Apple through their official support channels and consider filing a complaint with local cybercrime authorities. For additional protection, review connected devices and remove any that are unrecognized. Users should also clear browser cache and cookies to remove any residual tracking elements from the phishing site.