roshanrana05[.]github[.]io

PhishDestroy identifies roshanrana05.github.io as an active credential theft phishing domain posing significant risks to unsuspecting users. This GitHub-hosted page leverages social engineering tactics to harvest login credentials, likely targeting victims through deceptive links or spoofed login prompts. The domain's reliance on GitHub's infrastructure adds a veneer of legitimacy, tricking users into entering sensitive information under false pretenses. Security teams should treat this domain as a high-priority threat due to its active exploitation and multi-vendor detection rate. This domain was flagged by 17 out of 95 VirusTotal security vendors, while Google Safe Browsing explicitly categorized it as SOCIAL_ENGINEERING. It appears on 1 security blocklist and is served via a Let's Encrypt SSL certificate from IP 185.199.108.153. The page is hosted on GitHub, Inc., a legitimate service often abused by threat actors to host malicious content. Its infrastructure footprint—resolving to a single IP address with a recently issued certificate—suggests opportunistic deployment rather than a sophisticated long-term operation. Users who accessed this domain should immediately check for unauthorized login attempts or changes to their accounts. If credentials were entered, reset passwords immediately and enable multi-factor authentication where available. Organizations should block this domain at the firewall or DNS level and investigate any internal endpoints that may have communicated with it. Proactive monitoring for associated IOCs (e.g., the IP or certificate details) is strongly advised to prevent further compromise.