divyanshi-gif[.]github[.]io

This domain, divyanshi-gif.github.io, is flagged for credential theft activity targeting users through deceptive login prompts or account verification schemes. Analysis indicates the domain leverages GitHub Pages infrastructure to host malicious content, a tactic increasingly observed in phishing campaigns due to the platform's trusted reputation and SSL encryption. No specific brand impersonation or crypto drainer kit signatures were identified in initial scans, though credential harvesting remains the primary objective based on behavioral patterns and vendor detections. Infrastructure analysis reveals the domain resolves to IP address 185.199.108.153, hosted by GitHub, Inc. in the United States. The domain was registered on May 09, 2026, though this date may reflect GitHub Pages' automated assignment rather than traditional WHOIS registration. Security vendor detections on VirusTotal report 16/95 engines flagging the domain as malicious, while Google Safe Browsing explicitly categorizes it as phishing. The domain appears on one security blocklist, and its SSL certificate, issued by Let's Encrypt (R12), provides encryption without validating legitimacy. The page currently displays a 'Site not found' error, suggesting either takedown efforts or temporary concealment of malicious content. Current status remains active, with no confirmed remediation by the hosting provider. The domain's use of GitHub Pages infrastructure complicates mitigation, as legitimate and malicious content often share the same IP ranges. Users are advised to block the domain at the network level and monitor for credential reuse if interaction occurred. Organizations should update endpoint protection rules to include this domain and its associated IP, while also reviewing logs for connections to 185.199.108.153. Despite the apparent inactivity, the domain retains high-risk potential due to its verified credential theft intent and persistent blocklist presence.