ramandeepkaur606[.]github[.]io

ramandeepkaur606.github.io is currently listed on two reputable phishing blocklists, PhishDestroy and OpenPhish, indicating that security vendors have observed phishing‑related activity originating from this host. The domain resolves to the IP address 185.199.108.153, which belongs to the GitHub Pages infrastructure operated by GitHub, Inc. The registration information confirms that the domain is a sub‑domain of the github.io hosting service, a legitimate platform frequently abused for malicious purposes because it provides free TLS and easy deployment. VirusTotal analysis shows that 7 out of 91 scanned security engines flagged the domain as malicious, reinforcing the blocklist findings. The domain remains active as of the report date, and no evidence of takedown or remediation has been observed.

The available intelligence does not include a page title, HTTP response codes, SSL certificate details, or any observed payloads, leaving the exact phishing vector and targeted brand undefined. Nameserver data is unavailable, likely because GitHub’s default DNS configuration is used. Consequently, the specific content hosted at the URL cannot be verified without direct inspection, and the precise social‑engineering technique employed remains uncertain. Defenders should treat ramandeepkaur606.github.io as a high‑risk phishing indicator.

Immediate actions include adding the domain to network‑level deny lists, configuring web‑gateway filters to block traffic, and monitoring outbound connections to the associated IP address for anomalous activity. Organizations should also educate users about the risk of unsolicited links that resolve to GitHub Pages sub‑domains, especially when the destination is not verified. Continuous re‑evaluation is advised, as changes to the hosted content could alter the threat profile.