kankanadas-030604[.]github[.]io

This domain (kankanadas-030604.github.io) is currently active and has been observed hosting a generic phishing campaign. The site resolves to the public GitHub Pages IP address 185.199.108.153, indicating that the attacker is leveraging GitHub’s free hosting service. Registration information shows the domain was created through GitHub, Inc., and no separate nameserver records were found (NS_NOT_FOUND). The domain is listed on two reputable phishing blocklists, PhishDestroy and OpenPhish, and both services actively block traffic to it.

VirusTotal analysis shows that 9 out of 91 scanned security vendors flagged the domain as malicious, providing additional confirmation of its abusive nature. The risk rating assigned by the reporting platform is high, reflecting the combination of active status, blocklist listings, and vendor detections. Evidence gaps remain: the page title, specific brand impersonated, and the exact phishing payload have not been publicly disclosed, limiting attribution of the campaign’s target. No SSL certificate details, HTTP response codes, or Safe Browsing verdicts are available in the current data set.

Consequently, defenders cannot confirm whether the site serves a login clone, credential‑harvesting form, or other malicious content. Defensive recommendations include adding the domain to local deny lists, configuring proxy or firewall rules to block outbound connections to 185.199.108.153 when associated with user‑initiated traffic, and monitoring DNS queries for the domain. Organizations should also incorporate the two blocklist entries into their phishing‑filtering solutions and consider periodic re‑scans on VirusTotal to detect any changes in vendor verdicts. Continued observation of GitHub‑hosted phishing domains is advised, as the platform’s legitimate services can obscure malicious activity.