# PhishDestroy threat dossier — rathorepranjal.github.io ================================================================ Fetched: 2026-05-05 02:47:19 UTC Canonical: https://phishdestroy.io/domain/rathorepranjal.github.io/ ## VERDICT ---------------------------------------------------------------- ACTIVE THREAT — multiple warning signs Composite threat score: 51/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 15/91 security vendors flagged this domain Flagging vendors: ADMINUSLabs, alphaMountain.ai, BitDefender, CyRadar, ESET, Emsisoft, Fortinet, G-Data, Lionic, MalwareURL, Netcraft, Sophos, URLQuery, VIPRE, Webroot ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 185.199.108.153 (US, San Francisco) ASN: AS54113 Fastly, Inc. Hosting org: GitHub, Inc Registrar: GitHub, Inc. Nameservers: NS_NOT_FOUND Registered: 2026-05-05 Page title: Site not found · GitHub Pages HTTP response: 404 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / R12 Expires: 2026-07-05 Status: INVALID chain Fingerprint: ea69bc711cb9d45698d2fdaa4854d7dc086acd3a9c350164909b688ac7c0631f Subject Alternative Names (related infrastructure — often same operator): - github.com - github.io - githubusercontent.com ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-05-05 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-05-05 03:10:26 UTC (by PhishDestroy tracker) Last verified: 2026-05-05 05:35:23 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019df576-e741-71c0-b4dd-f3695edee0b2/ Wayback Machine: https://web.archive.org/web/*/rathorepranjal.github.io crt.sh CT logs: https://crt.sh/?q=%25.rathorepranjal.github.io Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=rathorepranjal.github.io AlienVault OTX: https://otx.alienvault.com/indicator/domain/rathorepranjal.github.io URLhaus: https://urlhaus.abuse.ch/host/rathorepranjal.github.io/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-05-05 03:11:17 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies the site hosted at rathorepranjal.github.io as a browser-update phishing page designed to trick visitors into downloading malware disguised as a software update. When loaded in a browser, the page displays urgent messages such as “Your browser is outdated” or “Critical security patch required,” prompting users to click a fake update button. Behind the scenes, clicking the button typically triggers the download of a malicious executable or script that can steal credentials, install keyloggers, or open backdoors on the victim’s device, making this a high-stakes social-engineering trap rather than a simple annoyance. This domain was flagged by 15 out of 95 VirusTotal security vendors exactly as a browser-update phishing page. It was created as a GitHub Pages site under the user rathorepranjal on GitHub, Inc., and currently resolves to the IP address 185.199.108.153. Let’s Encrypt supplies a valid SSL certificate, giving the page a deceptive veneer of legitimacy. While GitHub Pages itself is a legitimate hosting service, attackers frequently abuse it to host phishing kits and fake update pages that appear to come from trusted domains, leveraging the platform’s good reputation to bypass browser warnings. The combination of a convincing appearance, a valid certificate, and the familiar github.io domain suffix lowers user suspicion and increases the likelihood of successful compromise. If you visited rathorepranjal.github.io and saw any pop-ups or messages urging you to “update your browser immediately,” do not click anything—close the tab or window right away. If you downloaded a file from the page, do not open it; instead, run a full antivirus scan on your device using a trusted security suite. You should also reset any saved browser passwords and enable multi-factor authentication wherever possible. Report the domain to your antivirus provider and consider running an online scan at VirusTotal using the URL https://rathorepranjal.github.io to confirm its status. Even though the SSL certificate appears valid, it cannot guarantee the safety of the site’s content—treat unexpected update prompts as red flags and always verify by visiting the software vendor’s official website directly. ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: ea69bc711cb9d45698d2fdaa4854d7dc086acd3a9c350164909b688ac7c0631f ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/rathorepranjal.github.io/ JSON API: https://api.destroy.tools/v1/check?domain=rathorepranjal.github.io Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 145,775 domains (55,945 alive under monitoring, 89,567 confirmed takedowns/dead). Site: https://phishdestroy.io