himanshu8in[.]github[.]io

PhishDestroy identifies a live credential-harvesting campaign hosted on GitHub Pages at himanshu8in.github.io that masquerades as a legitimate service to trick visitors into submitting login credentials. The domain resolves to 185.199.108.153 and currently maintains a TLS certificate issued by Let’s Encrypt, giving the false appearance of legitimacy. This is not a generic lure; it specifically targets users’ passwords and sensitive data.

Technical review confirms the elevated risk: VirusTotal flags 16 of 95 security engines, indicating broad but incomplete detection coverage. The domain is registered with GitHub Pages, a free publishing platform often abused for low-cost phishing infrastructures. At the time of analysis, this campaign is active and ongoing, with no blocklist count officially disclosed yet.

If you accessed himanshu8in.github.io, immediately stop and check any credentials you entered. Revoke the exposed passwords in your account settings, enable multi-factor authentication on all affected services, and run a reputable password manager audit. Report the domain to your security team and GitHub’s abuse channel so the page can be taken down promptly. Monitor financial accounts for anomalous transactions for at least 30 days.