mohitkumar21919-sudo[.]github[.]io

PhishDestroy identifies mohitkumar21919-sudo.github.io as an active credential-harvesting phishing site hosted on GitHub Pages. This fraudulent subdomain is designed to mimic legitimate login portals, tricking users into entering sensitive credentials that are immediately exfiltrated to attacker-controlled servers. The page is engineered to harvest usernames, passwords, and potentially multi-factor authentication codes, posing a severe risk to personal accounts and corporate assets if credentials are reused across services.

This domain was flagged after resolving to IP address 185.199.108.153 and returning a clean scan result of 0 detections out of 95 engines on VirusTotal, indicating it remains undetected by standard antivirus definitions. The site is registered through GitHub, Inc., leveraging the platform’s trusted infrastructure to evade traditional domain-based filtering. Additionally, it utilizes a Let’s Encrypt SSL certificate to appear legitimate, encrypting traffic to hide exfiltration from network monitoring tools. Despite its current obscurity, this site has been active long enough to warrant human-level scrutiny and proactive blocking.

Users who visited mohitkumar21919-sudo.github.io should immediately audit their account credentials for potential exposure and enable account recovery options such as password reset and backup email verification. If any login was attempted, change passwords immediately, revoke active sessions, and monitor accounts for suspicious activity. Avoid entering sensitive information on any page hosted under this subdomain. Organizations should block this domain and IP at the network firewall level and update browser-based blocklists to prevent further access. Report any interactions to PhishDestroy or your internal security team for forensic analysis.