hemasai333[.]github[.]io

PhishDestroy identifies that the domain hemasai333.github.io is actively hosting cloned login pages designed to harvest user credentials. This campaign mimics legitimate login portals to trick victims into entering their usernames, passwords, or other sensitive information. The page is hosted on GitHub Pages, which can make it appear more credible to recipients who do not inspect the URL closely. Threat actors commonly abuse GitHub Pages for this purpose due to the platform’s reputation and ability to serve content over HTTPS, adding a false sense of security. This domain was flagged by 14 out of 95 security vendors on VirusTotal, indicating elevated risk. It resolves to IP address 185.199.108.153 and holds a valid SSL certificate issued by Let’s Encrypt, which may deceive users into believing the site is secure. The domain is registered through GitHub, Inc., leveraging the platform’s infrastructure to host and distribute phishing content. The campaign is currently active and may spread via email, messaging apps, or social media with links pointing to this malicious endpoint. Intelligence suggests this operation is part of a broader trend where threat actors exploit free hosting services to lower operational costs and evade detection. If you visited hemasai333.github.io, avoid entering any personal or login information. Immediately close the browser tab and scan your device for malware using a trusted antivirus tool. If you entered credentials, change your passwords immediately—especially for work, email, financial, or cloud accounts—and enable multi-factor authentication where available. Report the incident to your IT team or platform administrators if this relates to a business account. Do not trust subsequent communications from the same sender or similar domains without verification. Always verify URLs before clicking, hover over links to reveal their true destination, and rely on official channels for login requests.